From c989d5e1ac66991707a0f3f1e335a310320c652c Mon Sep 17 00:00:00 2001
From: denis <denis@miraceti.net>
Date: Tue, 24 Sep 2024 14:03:00 +0200
Subject: [PATCH] first commit

---
 .gitattributes                                | 223 ++++++++++++++++++
 README.md                                     |  19 ++
 fail2ban/action.d/f2b-iptables-allports.conf  |  71 ++++++
 fail2ban/action.d/f2b-iptables-multiport.conf |  82 +++++++
 .../action.d/f2b-mqtt-action-publisher.conf   |  14 ++
 .../action.d/f2b_mqtt_action_publisher.py     |  59 +++++
 fail2ban/filters.d/ban.conf                   |  17 ++
 fail2ban/filters.d/multiban.conf              |  16 ++
 fail2ban/filters.d/portscan.conf              |  26 ++
 fail2ban/jail-example.local                   |  29 +++
 requirement.txt                               |   2 +
 11 files changed, 558 insertions(+)
 create mode 100644 .gitattributes
 create mode 100644 README.md
 create mode 100644 fail2ban/action.d/f2b-iptables-allports.conf
 create mode 100644 fail2ban/action.d/f2b-iptables-multiport.conf
 create mode 100644 fail2ban/action.d/f2b-mqtt-action-publisher.conf
 create mode 100644 fail2ban/action.d/f2b_mqtt_action_publisher.py
 create mode 100644 fail2ban/filters.d/ban.conf
 create mode 100644 fail2ban/filters.d/multiban.conf
 create mode 100644 fail2ban/filters.d/portscan.conf
 create mode 100644 fail2ban/jail-example.local
 create mode 100644 requirement.txt

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..1516e0b
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,223 @@
+## GITATTRIBUTES FOR WEB PROJECTS
+#
+# These settings are for any web project.
+#
+# Details per file setting:
+#   text    These files should be normalized (i.e. convert CRLF to LF).
+#   binary  These files are binary and should be left untouched.
+#
+# Note that binary is a macro for -text -diff.
+######################################################################
+
+# Auto detect
+##   Handle line endings automatically for files detected as
+##   text and leave all files detected as binary untouched.
+##   This will handle all files NOT defined below.
+*                 text=auto
+
+# Source code
+*.bash            text eol=lf
+*.bat             text eol=crlf
+*.cmd             text eol=crlf
+*.coffee          text
+*.css             text diff=css
+*.htm             text diff=html
+*.html            text diff=html
+*.inc             text
+*.ini             text
+*.js              text
+*.mjs             text
+*.cjs             text
+*.json            text
+*.jsx             text
+*.less            text
+*.ls              text
+*.map             text -diff
+*.od              text
+*.onlydata        text
+*.php             text diff=php
+*.pl              text
+*.ps1             text eol=crlf
+*.py              text diff=python
+*.rb              text diff=ruby
+*.sass            text
+*.scm             text
+*.scss            text diff=css
+*.sh              text eol=lf
+.husky/*          text eol=lf
+*.sql             text
+*.styl            text
+*.tag             text
+*.ts              text
+*.tsx             text
+*.xml             text
+*.xhtml           text diff=html
+
+# Docker
+Dockerfile        text
+
+# Documentation
+*.ipynb           text eol=lf
+*.markdown        text diff=markdown
+*.md              text diff=markdown
+*.mdwn            text diff=markdown
+*.mdown           text diff=markdown
+*.mkd             text diff=markdown
+*.mkdn            text diff=markdown
+*.mdtxt           text
+*.mdtext          text
+*.txt             text
+AUTHORS           text
+CHANGELOG         text
+CHANGES           text
+CONTRIBUTING      text
+COPYING           text
+copyright         text
+*COPYRIGHT*       text
+INSTALL           text
+license           text
+LICENSE           text
+NEWS              text
+readme            text
+*README*          text
+TODO              text
+
+# Templates
+*.dot             text
+*.ejs             text
+*.erb             text
+*.haml            text
+*.handlebars      text
+*.hbs             text
+*.hbt             text
+*.jade            text
+*.latte           text
+*.mustache        text
+*.njk             text
+*.phtml           text
+*.svelte          text
+*.tmpl            text
+*.tpl             text
+*.twig            text
+*.vue             text
+
+# Configs
+*.cnf             text
+*.conf            text
+*.config          text
+.editorconfig     text
+.env              text
+.gitattributes    text
+.gitconfig        text
+.htaccess         text
+*.lock            text -diff
+package.json      text eol=lf
+package-lock.json text eol=lf -diff
+pnpm-lock.yaml    text eol=lf -diff
+.prettierrc       text
+yarn.lock         text -diff
+*.toml            text
+*.yaml            text
+*.yml             text
+browserslist      text
+Makefile          text
+makefile          text
+# Fixes syntax highlighting on GitHub to allow comments
+tsconfig.json     linguist-language=JSON-with-Comments
+
+# Heroku
+Procfile          text
+
+# Graphics
+*.ai              binary
+*.bmp             binary
+*.eps             binary
+*.gif             binary
+*.gifv            binary
+*.ico             binary
+*.jng             binary
+*.jp2             binary
+*.jpg             binary
+*.jpeg            binary
+*.jpx             binary
+*.jxr             binary
+*.pdf             binary
+*.png             binary
+*.psb             binary
+*.psd             binary
+# SVG treated as an asset (binary) by default.
+*.svg             text
+# If you want to treat it as binary,
+# use the following line instead.
+# *.svg           binary
+*.svgz            binary
+*.tif             binary
+*.tiff            binary
+*.wbmp            binary
+*.webp            binary
+
+# Audio
+*.kar             binary
+*.m4a             binary
+*.mid             binary
+*.midi            binary
+*.mp3             binary
+*.ogg             binary
+*.ra              binary
+
+# Video
+*.3gpp            binary
+*.3gp             binary
+*.as              binary
+*.asf             binary
+*.asx             binary
+*.avi             binary
+*.fla             binary
+*.flv             binary
+*.m4v             binary
+*.mng             binary
+*.mov             binary
+*.mp4             binary
+*.mpeg            binary
+*.mpg             binary
+*.ogv             binary
+*.swc             binary
+*.swf             binary
+*.webm            binary
+
+# Archives
+*.7z              binary
+*.gz              binary
+*.jar             binary
+*.rar             binary
+*.tar             binary
+*.zip             binary
+
+# Fonts
+*.ttf             binary
+*.eot             binary
+*.otf             binary
+*.woff            binary
+*.woff2           binary
+
+# Executables
+*.exe             binary
+*.pyc             binary
+# Prevents massive diffs caused by vendored, minified files
+**/.yarn/releases/**   binary
+**/.yarn/plugins/**    binary
+
+# RC files (like .babelrc or .eslintrc)
+*.*rc             text
+
+# Ignore files (like .npmignore or .gitignore)
+*.*ignore         text
+
+# Prevents massive diffs from built files
+dist/*            binary
+
+*.py linguist-detectable=true
+*.html linguist-detectable=true
+*.css linguist-detectable=false
+*.js linguist-detectable=false
+
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..cfd7487
--- /dev/null
+++ b/README.md
@@ -0,0 +1,19 @@
+# Fail2banMqttActionublisher
+Fail2ban action: publish all server banished
+
+### Actions in action.d
+
+### Configuration mqtt broker or local mosquitto
+action.d/f2b_mqtt_action_publisher.py
+
+
+
+
+### Usage
+Add action as jail-example.local
+
+        systemctl restart fail2ban.service
+        
+### Control
+    
+        tail -f /var/log/mosquitto/mosqitto.log
diff --git a/fail2ban/action.d/f2b-iptables-allports.conf b/fail2ban/action.d/f2b-iptables-allports.conf
new file mode 100644
index 0000000..7853d5c
--- /dev/null
+++ b/fail2ban/action.d/f2b-iptables-allports.conf
@@ -0,0 +1,71 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
+# 			made active on all ports from original iptables.conf
+#
+# $Revision$
+#
+
+[Definition]
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -j fail2ban-<name>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
+
diff --git a/fail2ban/action.d/f2b-iptables-multiport.conf b/fail2ban/action.d/f2b-iptables-multiport.conf
new file mode 100644
index 0000000..08105f2
--- /dev/null
+++ b/fail2ban/action.d/f2b-iptables-multiport.conf
@@ -0,0 +1,82 @@
+# Fail2Ban configuration file
+#
+# Author: Cyril Jaquier
+# Modified by Yaroslav Halchenko for multiport banning
+# $Revision$
+#
+
+[Definition]
+
+# Option:  blocktype
+# Note:    This is what the action does with rules. This can be any jump target
+#          as per the iptables man page (section 8). Common values are DROP
+#          REJECT, REJECT --reject-with icmp-port-unreachable
+# Values:  STRING
+#blocktype = REJECT --reject-with icmp-port-unreachable
+
+# Option:  actionstart
+# Notes.:  command executed once at the start of Fail2Ban.
+# Values:  CMD
+#
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+
+# Option:  actionstop
+# Notes.:  command executed once at the end of Fail2Ban
+# Values:  CMD
+#
+actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+			 <iptables> -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+
+# Option:  actioncheck
+# Notes.:  command executed once before each actionban command
+# Values:  CMD
+#
+actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
+
+
+# Option:  actionban
+# Notes.:  command executed when banning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+
+# Option:  actionunban
+# Notes.:  command executed when unbanning an IP. Take care that the
+#          command is executed with Fail2Ban user rights.
+# Tags:    <ip>  IP address
+#          <failures>  number of failures
+#          <time>  unix timestamp of the ban time
+# Values:  CMD
+#
+actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
+
+[Init]
+
+# Defaut name of the chain
+#
+name = default
+
+# Option:  port
+# Notes.:  specifies port to monitor
+# Values:  [ NUM | STRING ]  Default:
+#
+port = ssh
+
+# Option:  protocol
+# Notes.:  internally used by config reader for interpolations.
+# Values:  [ tcp | udp | icmp | all ] Default: tcp
+#
+protocol = tcp
+
+# Option:  chain
+# Notes    specifies the iptables chain to which the fail2ban rules should be
+#          added
+# Values:  STRING  Default: INPUT
+chain = INPUT
diff --git a/fail2ban/action.d/f2b-mqtt-action-publisher.conf b/fail2ban/action.d/f2b-mqtt-action-publisher.conf
new file mode 100644
index 0000000..4dd05c3
--- /dev/null
+++ b/fail2ban/action.d/f2b-mqtt-action-publisher.conf
@@ -0,0 +1,14 @@
+# action publisher
+[Definition]
+actionstart =
+#echo "$(date '+%%Y-%%m-%%d %%T') fail2ban.actions \t\t[mqtt_publisher] start" >> /var/log/fail2ban.log
+
+actioncheck =
+
+actionban = /etc/fail2ban/action.d/f2b_mqtt_action_publisher.py "{\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}"
+#echo "$(date '+%%Y-%%m-%%d %%T') [mqtt-publisher] {\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}" >> /var/log/fail2ban.log
+
+actionunban =
+
+[Init]
+init = Mqtt publisher loaded
\ No newline at end of file
diff --git a/fail2ban/action.d/f2b_mqtt_action_publisher.py b/fail2ban/action.d/f2b_mqtt_action_publisher.py
new file mode 100644
index 0000000..7dfcbbd
--- /dev/null
+++ b/fail2ban/action.d/f2b_mqtt_action_publisher.py
@@ -0,0 +1,59 @@
+#!/usr/bin/python3
+'''
+Created on 20 mai 2020
+
+@author: denis@miraceti.net
+'''
+import sys, json, uuid, datetime
+import paho.mqtt.publish as publish
+
+#HOST = 'broker.emqx.io'
+#PORT = 1883
+#AUTH = dict(username='emqx', password='public')
+
+HOST = "127.0.0.1"
+PORT = 1883
+AUTH = dict(username='fail2ban', password='banishing')
+
+LOG_FILE = '/var/log/fail2ban.log'
+
+nodeid = uuid.getnode()
+node_type = 'fail2ban'
+base_topic = '%s/%s' % (node_type, nodeid, )
+mqtt_publish_params = dict(
+    qos=0,
+    retain=False,
+    hostname=HOST,
+    port=PORT,
+    keepalive=60,
+    auth=AUTH,
+    client_id='%s_%s'% (node_type, nodeid),
+)
+
+
+def print_message(message):
+    try:
+        with open(LOG_FILE, 'a') as f:
+            f.write('{} [MQTT PUBLISHER] {}'.format(datetime.datetime.now(), message))
+    except Exception as e:
+        print("fai2ban mqtt error", e)
+
+
+def publish_message(topic, **payload):
+    try:
+        message = json.dumps(payload)
+        publish.single(base_topic + topic, message, **mqtt_publish_params)
+    except Exception as e:
+        print_message("publish_message error {}".format(e))
+
+
+def main():
+    try:
+        payload = json.loads(sys.argv[1])
+        publish_message('/jail', node=nodeid, **payload)
+    except Exception as e:
+        print_message("main error %s".format(e))
+
+if __name__ == '__main__':
+    main()
+
diff --git a/fail2ban/filters.d/ban.conf b/fail2ban/filters.d/ban.conf
new file mode 100644
index 0000000..65cbc93
--- /dev/null
+++ b/fail2ban/filters.d/ban.conf
@@ -0,0 +1,17 @@
+# Fail2Ban configuration file
+#
+# Author: Nicolargo
+#
+[Definition]
+ 
+# Option: failregex
+# Filter Ban in the fail2ban.log
+ 
+failregex = .*\ Ban\ <HOST>
+ 
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
+
diff --git a/fail2ban/filters.d/multiban.conf b/fail2ban/filters.d/multiban.conf
new file mode 100644
index 0000000..2c633ed
--- /dev/null
+++ b/fail2ban/filters.d/multiban.conf
@@ -0,0 +1,16 @@
+# Fail2Ban configuration file
+#
+# Author: Nicolargo
+#
+[Definition]
+
+# Option: failregex
+# Filter multi-ban in the fail2ban.log
+
+failregex = .*\[multi-ban\]\ Ban\ <HOST>
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
diff --git a/fail2ban/filters.d/portscan.conf b/fail2ban/filters.d/portscan.conf
new file mode 100644
index 0000000..2f0837f
--- /dev/null
+++ b/fail2ban/filters.d/portscan.conf
@@ -0,0 +1,26 @@
+[INCLUDES]
+[Definition]
+#stop portscanning
+#
+# Option:  failregex
+# Notes.:  regex to match the password failures messages in the logfile. The
+#          host must be matched by a group named "host". The tag "<HOST>" can
+#          be used for standard IP/hostname matching and is only an alias for
+#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
+# Notes: Looks for attempts on ports not open in your firewall. Expects the
+# iptables logging utility to be used. Add the following to your iptables
+# config, as the last item before you DROP or REJECT:
+# -A <chain_name> -j LOG --log-prefix "[IPTABLES DROP] : " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence
+# This will place a notice in /var/log/messages about any attempt on a port that isn't open.
+#
+#Sep  7 03:28:39 orion kernel: [IPTABLES DROP] : IN=eth0 OUT= MAC=e8:40:f2:ec:d7:6d:6c:9c:ed:ba:ec:40:08:00
+#SRC=171.34.9.13 DST=142.4.213.118 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=51120 DF PROTO=TCP SPT=1682 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
+#
+failregex = .* \[IPTABLES DROP\] .* SRC=<HOST> DST=<F-DST>\S+</F-DST> .* SPT=<F-SPT>\S+</F-SPT> DPT=<F-DPT>\d+</F-DPT> .*
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#
+ignoreregex =
+
diff --git a/fail2ban/jail-example.local b/fail2ban/jail-example.local
new file mode 100644
index 0000000..8e48a25
--- /dev/null
+++ b/fail2ban/jail-example.local
@@ -0,0 +1,29 @@
+#
+[DEFAULT]
+ignoreip   = 127.0.0.0/8 10.8.10.0/24
+findtime = 2m
+bantime  = 10m
+maxretry = 3
+destemail  = admin@miraceti.net
+mta        = mail
+action     = %(action_)s
+banaction  = f2b-iptables-multiport
+             f2b-mqtt-action-publisher[action=NOTICE]
+banaction_allports = f2b-iptables-allports
+                     f2b-mqtt-action-publisher[action=NOTICE]
+                     
+# JAILS
+
+[portscan]
+enabled = false
+filter  = portscan
+logpath = /var/log/messages
+action  = f2b-iptables-multiport
+          f2b-mqtt-action-publisher[action=INFO]
+findtime = 2m
+bantime  = 30
+maxretry = 1
+
+
+
+
diff --git a/requirement.txt b/requirement.txt
new file mode 100644
index 0000000..86852d0
--- /dev/null
+++ b/requirement.txt
@@ -0,0 +1,2 @@
+#
+paho-mqtt