first commit
This commit is contained in:
denis
+223
@@ -0,0 +1,223 @@
|
||||
## GITATTRIBUTES FOR WEB PROJECTS
|
||||
#
|
||||
# These settings are for any web project.
|
||||
#
|
||||
# Details per file setting:
|
||||
# text These files should be normalized (i.e. convert CRLF to LF).
|
||||
# binary These files are binary and should be left untouched.
|
||||
#
|
||||
# Note that binary is a macro for -text -diff.
|
||||
######################################################################
|
||||
|
||||
# Auto detect
|
||||
## Handle line endings automatically for files detected as
|
||||
## text and leave all files detected as binary untouched.
|
||||
## This will handle all files NOT defined below.
|
||||
* text=auto
|
||||
|
||||
# Source code
|
||||
*.bash text eol=lf
|
||||
*.bat text eol=crlf
|
||||
*.cmd text eol=crlf
|
||||
*.coffee text
|
||||
*.css text diff=css
|
||||
*.htm text diff=html
|
||||
*.html text diff=html
|
||||
*.inc text
|
||||
*.ini text
|
||||
*.js text
|
||||
*.mjs text
|
||||
*.cjs text
|
||||
*.json text
|
||||
*.jsx text
|
||||
*.less text
|
||||
*.ls text
|
||||
*.map text -diff
|
||||
*.od text
|
||||
*.onlydata text
|
||||
*.php text diff=php
|
||||
*.pl text
|
||||
*.ps1 text eol=crlf
|
||||
*.py text diff=python
|
||||
*.rb text diff=ruby
|
||||
*.sass text
|
||||
*.scm text
|
||||
*.scss text diff=css
|
||||
*.sh text eol=lf
|
||||
.husky/* text eol=lf
|
||||
*.sql text
|
||||
*.styl text
|
||||
*.tag text
|
||||
*.ts text
|
||||
*.tsx text
|
||||
*.xml text
|
||||
*.xhtml text diff=html
|
||||
|
||||
# Docker
|
||||
Dockerfile text
|
||||
|
||||
# Documentation
|
||||
*.ipynb text eol=lf
|
||||
*.markdown text diff=markdown
|
||||
*.md text diff=markdown
|
||||
*.mdwn text diff=markdown
|
||||
*.mdown text diff=markdown
|
||||
*.mkd text diff=markdown
|
||||
*.mkdn text diff=markdown
|
||||
*.mdtxt text
|
||||
*.mdtext text
|
||||
*.txt text
|
||||
AUTHORS text
|
||||
CHANGELOG text
|
||||
CHANGES text
|
||||
CONTRIBUTING text
|
||||
COPYING text
|
||||
copyright text
|
||||
*COPYRIGHT* text
|
||||
INSTALL text
|
||||
license text
|
||||
LICENSE text
|
||||
NEWS text
|
||||
readme text
|
||||
*README* text
|
||||
TODO text
|
||||
|
||||
# Templates
|
||||
*.dot text
|
||||
*.ejs text
|
||||
*.erb text
|
||||
*.haml text
|
||||
*.handlebars text
|
||||
*.hbs text
|
||||
*.hbt text
|
||||
*.jade text
|
||||
*.latte text
|
||||
*.mustache text
|
||||
*.njk text
|
||||
*.phtml text
|
||||
*.svelte text
|
||||
*.tmpl text
|
||||
*.tpl text
|
||||
*.twig text
|
||||
*.vue text
|
||||
|
||||
# Configs
|
||||
*.cnf text
|
||||
*.conf text
|
||||
*.config text
|
||||
.editorconfig text
|
||||
.env text
|
||||
.gitattributes text
|
||||
.gitconfig text
|
||||
.htaccess text
|
||||
*.lock text -diff
|
||||
package.json text eol=lf
|
||||
package-lock.json text eol=lf -diff
|
||||
pnpm-lock.yaml text eol=lf -diff
|
||||
.prettierrc text
|
||||
yarn.lock text -diff
|
||||
*.toml text
|
||||
*.yaml text
|
||||
*.yml text
|
||||
browserslist text
|
||||
Makefile text
|
||||
makefile text
|
||||
# Fixes syntax highlighting on GitHub to allow comments
|
||||
tsconfig.json linguist-language=JSON-with-Comments
|
||||
|
||||
# Heroku
|
||||
Procfile text
|
||||
|
||||
# Graphics
|
||||
*.ai binary
|
||||
*.bmp binary
|
||||
*.eps binary
|
||||
*.gif binary
|
||||
*.gifv binary
|
||||
*.ico binary
|
||||
*.jng binary
|
||||
*.jp2 binary
|
||||
*.jpg binary
|
||||
*.jpeg binary
|
||||
*.jpx binary
|
||||
*.jxr binary
|
||||
*.pdf binary
|
||||
*.png binary
|
||||
*.psb binary
|
||||
*.psd binary
|
||||
# SVG treated as an asset (binary) by default.
|
||||
*.svg text
|
||||
# If you want to treat it as binary,
|
||||
# use the following line instead.
|
||||
# *.svg binary
|
||||
*.svgz binary
|
||||
*.tif binary
|
||||
*.tiff binary
|
||||
*.wbmp binary
|
||||
*.webp binary
|
||||
|
||||
# Audio
|
||||
*.kar binary
|
||||
*.m4a binary
|
||||
*.mid binary
|
||||
*.midi binary
|
||||
*.mp3 binary
|
||||
*.ogg binary
|
||||
*.ra binary
|
||||
|
||||
# Video
|
||||
*.3gpp binary
|
||||
*.3gp binary
|
||||
*.as binary
|
||||
*.asf binary
|
||||
*.asx binary
|
||||
*.avi binary
|
||||
*.fla binary
|
||||
*.flv binary
|
||||
*.m4v binary
|
||||
*.mng binary
|
||||
*.mov binary
|
||||
*.mp4 binary
|
||||
*.mpeg binary
|
||||
*.mpg binary
|
||||
*.ogv binary
|
||||
*.swc binary
|
||||
*.swf binary
|
||||
*.webm binary
|
||||
|
||||
# Archives
|
||||
*.7z binary
|
||||
*.gz binary
|
||||
*.jar binary
|
||||
*.rar binary
|
||||
*.tar binary
|
||||
*.zip binary
|
||||
|
||||
# Fonts
|
||||
*.ttf binary
|
||||
*.eot binary
|
||||
*.otf binary
|
||||
*.woff binary
|
||||
*.woff2 binary
|
||||
|
||||
# Executables
|
||||
*.exe binary
|
||||
*.pyc binary
|
||||
# Prevents massive diffs caused by vendored, minified files
|
||||
**/.yarn/releases/** binary
|
||||
**/.yarn/plugins/** binary
|
||||
|
||||
# RC files (like .babelrc or .eslintrc)
|
||||
*.*rc text
|
||||
|
||||
# Ignore files (like .npmignore or .gitignore)
|
||||
*.*ignore text
|
||||
|
||||
# Prevents massive diffs from built files
|
||||
dist/* binary
|
||||
|
||||
*.py linguist-detectable=true
|
||||
*.html linguist-detectable=true
|
||||
*.css linguist-detectable=false
|
||||
*.js linguist-detectable=false
|
||||
|
||||
@@ -0,0 +1,19 @@
|
||||
# Fail2banMqttActionublisher
|
||||
Fail2ban action: publish all server banished
|
||||
|
||||
### Actions in action.d
|
||||
|
||||
### Configuration mqtt broker or local mosquitto
|
||||
action.d/f2b_mqtt_action_publisher.py
|
||||
|
||||
|
||||
|
||||
|
||||
### Usage
|
||||
Add action as jail-example.local
|
||||
|
||||
systemctl restart fail2ban.service
|
||||
|
||||
### Control
|
||||
|
||||
tail -f /var/log/mosquitto/mosqitto.log
|
||||
@@ -0,0 +1,71 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
# made active on all ports from original iptables.conf
|
||||
#
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -j fail2ban-<name>
|
||||
iptables -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
|
||||
@@ -0,0 +1,82 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Cyril Jaquier
|
||||
# Modified by Yaroslav Halchenko for multiport banning
|
||||
# $Revision$
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: blocktype
|
||||
# Note: This is what the action does with rules. This can be any jump target
|
||||
# as per the iptables man page (section 8). Common values are DROP
|
||||
# REJECT, REJECT --reject-with icmp-port-unreachable
|
||||
# Values: STRING
|
||||
#blocktype = REJECT --reject-with icmp-port-unreachable
|
||||
|
||||
# Option: actionstart
|
||||
# Notes.: command executed once at the start of Fail2Ban.
|
||||
# Values: CMD
|
||||
#
|
||||
actionstart = iptables -N fail2ban-<name>
|
||||
iptables -A fail2ban-<name> -j RETURN
|
||||
iptables -I <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
|
||||
# Option: actionstop
|
||||
# Notes.: command executed once at the end of Fail2Ban
|
||||
# Values: CMD
|
||||
#
|
||||
actionstop = iptables -D <chain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
|
||||
<iptables> -F fail2ban-<name>
|
||||
iptables -X fail2ban-<name>
|
||||
|
||||
# Option: actioncheck
|
||||
# Notes.: command executed once before each actionban command
|
||||
# Values: CMD
|
||||
#
|
||||
actioncheck = iptables -n -L <chain> | grep -q fail2ban-<name>
|
||||
|
||||
|
||||
# Option: actionban
|
||||
# Notes.: command executed when banning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionban = iptables -I fail2ban-<name> 1 -s <ip> -j DROP
|
||||
|
||||
# Option: actionunban
|
||||
# Notes.: command executed when unbanning an IP. Take care that the
|
||||
# command is executed with Fail2Ban user rights.
|
||||
# Tags: <ip> IP address
|
||||
# <failures> number of failures
|
||||
# <time> unix timestamp of the ban time
|
||||
# Values: CMD
|
||||
#
|
||||
actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
|
||||
|
||||
[Init]
|
||||
|
||||
# Defaut name of the chain
|
||||
#
|
||||
name = default
|
||||
|
||||
# Option: port
|
||||
# Notes.: specifies port to monitor
|
||||
# Values: [ NUM | STRING ] Default:
|
||||
#
|
||||
port = ssh
|
||||
|
||||
# Option: protocol
|
||||
# Notes.: internally used by config reader for interpolations.
|
||||
# Values: [ tcp | udp | icmp | all ] Default: tcp
|
||||
#
|
||||
protocol = tcp
|
||||
|
||||
# Option: chain
|
||||
# Notes specifies the iptables chain to which the fail2ban rules should be
|
||||
# added
|
||||
# Values: STRING Default: INPUT
|
||||
chain = INPUT
|
||||
@@ -0,0 +1,14 @@
|
||||
# action publisher
|
||||
[Definition]
|
||||
actionstart =
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') fail2ban.actions \t\t[mqtt_publisher] start" >> /var/log/fail2ban.log
|
||||
|
||||
actioncheck =
|
||||
|
||||
actionban = /etc/fail2ban/action.d/f2b_mqtt_action_publisher.py "{\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}"
|
||||
#echo "$(date '+%%Y-%%m-%%d %%T') [mqtt-publisher] {\"action\":\"<action>\",\"ip\": \"<ip>\", \"time\": \"<time>\", \"name\": \"<name>\", \"port\": \"<F-DPT>\", \"bantime\": \"<bantime>\"}" >> /var/log/fail2ban.log
|
||||
|
||||
actionunban =
|
||||
|
||||
[Init]
|
||||
init = Mqtt publisher loaded
|
||||
@@ -0,0 +1,59 @@
|
||||
#!/usr/bin/python3
|
||||
'''
|
||||
Created on 20 mai 2020
|
||||
|
||||
@author: denis@miraceti.net
|
||||
'''
|
||||
import sys, json, uuid, datetime
|
||||
import paho.mqtt.publish as publish
|
||||
|
||||
#HOST = 'broker.emqx.io'
|
||||
#PORT = 1883
|
||||
#AUTH = dict(username='emqx', password='public')
|
||||
|
||||
HOST = "127.0.0.1"
|
||||
PORT = 1883
|
||||
AUTH = dict(username='fail2ban', password='banishing')
|
||||
|
||||
LOG_FILE = '/var/log/fail2ban.log'
|
||||
|
||||
nodeid = uuid.getnode()
|
||||
node_type = 'fail2ban'
|
||||
base_topic = '%s/%s' % (node_type, nodeid, )
|
||||
mqtt_publish_params = dict(
|
||||
qos=0,
|
||||
retain=False,
|
||||
hostname=HOST,
|
||||
port=PORT,
|
||||
keepalive=60,
|
||||
auth=AUTH,
|
||||
client_id='%s_%s'% (node_type, nodeid),
|
||||
)
|
||||
|
||||
|
||||
def print_message(message):
|
||||
try:
|
||||
with open(LOG_FILE, 'a') as f:
|
||||
f.write('{} [MQTT PUBLISHER] {}'.format(datetime.datetime.now(), message))
|
||||
except Exception as e:
|
||||
print("fai2ban mqtt error", e)
|
||||
|
||||
|
||||
def publish_message(topic, **payload):
|
||||
try:
|
||||
message = json.dumps(payload)
|
||||
publish.single(base_topic + topic, message, **mqtt_publish_params)
|
||||
except Exception as e:
|
||||
print_message("publish_message error {}".format(e))
|
||||
|
||||
|
||||
def main():
|
||||
try:
|
||||
payload = json.loads(sys.argv[1])
|
||||
publish_message('/jail', node=nodeid, **payload)
|
||||
except Exception as e:
|
||||
print_message("main error %s".format(e))
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Nicolargo
|
||||
#
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Filter Ban in the fail2ban.log
|
||||
|
||||
failregex = .*\ Ban\ <HOST>
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
@@ -0,0 +1,16 @@
|
||||
# Fail2Ban configuration file
|
||||
#
|
||||
# Author: Nicolargo
|
||||
#
|
||||
[Definition]
|
||||
|
||||
# Option: failregex
|
||||
# Filter multi-ban in the fail2ban.log
|
||||
|
||||
failregex = .*\[multi-ban\]\ Ban\ <HOST>
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
@@ -0,0 +1,26 @@
|
||||
[INCLUDES]
|
||||
[Definition]
|
||||
#stop portscanning
|
||||
#
|
||||
# Option: failregex
|
||||
# Notes.: regex to match the password failures messages in the logfile. The
|
||||
# host must be matched by a group named "host". The tag "<HOST>" can
|
||||
# be used for standard IP/hostname matching and is only an alias for
|
||||
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
|
||||
# Notes: Looks for attempts on ports not open in your firewall. Expects the
|
||||
# iptables logging utility to be used. Add the following to your iptables
|
||||
# config, as the last item before you DROP or REJECT:
|
||||
# -A <chain_name> -j LOG --log-prefix "[IPTABLES DROP] : " --log-level 5 --log-ip-options --log-tcp-options --log-tcp-sequence
|
||||
# This will place a notice in /var/log/messages about any attempt on a port that isn't open.
|
||||
#
|
||||
#Sep 7 03:28:39 orion kernel: [IPTABLES DROP] : IN=eth0 OUT= MAC=e8:40:f2:ec:d7:6d:6c:9c:ed:ba:ec:40:08:00
|
||||
#SRC=171.34.9.13 DST=142.4.213.118 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=51120 DF PROTO=TCP SPT=1682 DPT=23 WINDOW=5840 RES=0x00 SYN URGP=0
|
||||
#
|
||||
failregex = .* \[IPTABLES DROP\] .* SRC=<HOST> DST=<F-DST>\S+</F-DST> .* SPT=<F-SPT>\S+</F-SPT> DPT=<F-DPT>\d+</F-DPT> .*
|
||||
|
||||
# Option: ignoreregex
|
||||
# Notes.: regex to ignore. If this regex matches, the line is ignored.
|
||||
# Values: TEXT
|
||||
#
|
||||
ignoreregex =
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
#
|
||||
[DEFAULT]
|
||||
ignoreip = 127.0.0.0/8 10.8.10.0/24
|
||||
findtime = 2m
|
||||
bantime = 10m
|
||||
maxretry = 3
|
||||
destemail = admin@miraceti.net
|
||||
mta = mail
|
||||
action = %(action_)s
|
||||
banaction = f2b-iptables-multiport
|
||||
f2b-mqtt-action-publisher[action=NOTICE]
|
||||
banaction_allports = f2b-iptables-allports
|
||||
f2b-mqtt-action-publisher[action=NOTICE]
|
||||
|
||||
# JAILS
|
||||
|
||||
[portscan]
|
||||
enabled = false
|
||||
filter = portscan
|
||||
logpath = /var/log/messages
|
||||
action = f2b-iptables-multiport
|
||||
f2b-mqtt-action-publisher[action=INFO]
|
||||
findtime = 2m
|
||||
bantime = 30
|
||||
maxretry = 1
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
#
|
||||
paho-mqtt
|
||||
Reference in New Issue
Block a user