first commit
This commit is contained in:
denis
@@ -0,0 +1,71 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
|
||||
iptables -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified by Yaroslav Halchenko for multiport banning
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
#blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
<iptables> -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
@@ -0,0 +1,14 @@
|
||||
# action publisher
|
||||
[Definition]
|
||||
actionstart =
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') fail2ban.actions \t\t[mqtt_publisher] start" >> /var/log/fail2ban.log
|
||||
|
||||
actioncheck =
|
||||
|
||||
actionban = /etc/fail2ban/action.d/f2b_mqtt_action_publisher.py "{\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}"
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') [mqtt-publisher] {\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}" >> /var/log/fail2ban.log
|
||||
|
||||
actionunban =
|
||||
|
||||
[Init]
|
||||
init = Mqtt publisher loaded
|
||||
@@ -0,0 +1,59 @@
|
||||
#!/usr/bin/python3
|
||||
'''
|
||||
Created on 20 mai 2020
|
||||
|
||||
@author: denis@miraceti.net
|
||||
'''
|
||||
import sys, json, uuid, datetime
|
||||
import paho.mqtt.publish as publish
|
||||
|
||||
#HOST = 'broker.emqx.io'
|
||||
#PORT = 1883
|
||||
#AUTH = dict(username='emqx', password='public')
|
||||
|
||||
HOST = "127.0.0.1"
|
||||
PORT = 1883
|
||||
AUTH = dict(username='fail2ban', password='banishing')
|
||||
|
||||
LOG_FILE = '/var/log/fail2ban.log'
|
||||
|
||||
nodeid = uuid.getnode()
|
||||
node_type = 'fail2ban'
|
||||
base_topic = '%s/%s' % (node_type, nodeid, )
|
||||
mqtt_publish_params = dict(
|
||||
qos=0,
|
||||
retain=False,
|
||||
hostname=HOST,
|
||||
port=PORT,
|
||||
keepalive=60,
|
||||
auth=AUTH,
|
||||
client_id='%s_%s'% (node_type, nodeid),
|
||||
)
|
||||
|
||||
|
||||
def print_message(message):
|
||||
try:
|
||||
with open(LOG_FILE, 'a') as f:
|
||||
f.write('{} [MQTT PUBLISHER] {}'.format(datetime.datetime.now(), message))
|
||||
except Exception as e:
|
||||
print("fai2ban mqtt error", e)
|
||||
|
||||
|
||||
def publish_message(topic, **payload):
|
||||
try:
|
||||
message = json.dumps(payload)
|
||||
publish.single(base_topic + topic, message, **mqtt_publish_params)
|
||||
except Exception as e:
|
||||
print_message("publish_message error {}".format(e))
|
||||
|
||||
|
||||
def main():
|
||||
try:
|
||||
payload = json.loads(sys.argv[1])
|
||||
publish_message('/jail', node=nodeid, **payload)
|
||||
except Exception as e:
|
||||
print_message("main error %s".format(e))
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
Reference in New Issue
Block a user