Browse Source

Update ynh_add_fail2ban_config helper

pull/38/head
Maniack Crudelis 8 years ago
committed by GitHub
parent
commit
32571e25b7
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
  1. 61
      scripts/_common.sh

61
scripts/_common.sh

@ -63,55 +63,56 @@ ynh_delete_file_checksum () {
# | arg: max_retry - Maximum number of retries allowed before banning IP address - default: 3 # | arg: max_retry - Maximum number of retries allowed before banning IP address - default: 3
# | arg: ports - Ports blocked for a banned IP address - default: http,https # | arg: ports - Ports blocked for a banned IP address - default: http,https
ynh_add_fail2ban_config () { ynh_add_fail2ban_config () {
# Process parameters
logpath=$1
failregex=$2
max_retry=${3:-3}
ports=${4:-http,https}
test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing."
test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing."
finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf"
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf"
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1
sudo tee $finalfail2banjailconf <<EOF
# Process parameters
logpath=$1
failregex=$2
max_retry=${3:-3}
ports=${4:-http,https}
test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing."
test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing."
finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf"
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf"
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1
sudo tee $finalfail2banjailconf <<EOF
[$app] [$app]
enabled = true enabled = true
port = $ports port = $ports
filter = $app filter = $app
logpath = $logpath logpath = $logpath
maxretry = $max_retry"
maxretry = $max_retry
EOF EOF
sudo tee $finalfail2banfilterconf <<EOF
sudo tee $finalfail2banfilterconf <<EOF
[INCLUDES] [INCLUDES]
before = common.conf before = common.conf
[Definition] [Definition]
failregex = $failregex failregex = $failregex
ignoreregrex ="
ignoreregex =
EOF EOF
ynh_store_file_checksum "$finalfail2banjailconf"
ynh_store_file_checksum "$finalfail2banfilterconf"
sudo systemctl restart fail2ban
if local fail2ban_error="$(tail -n50 /var/log/fail2ban.log | grep "WARNING Command.*$app.*addfailregex")"
then
echo "[ERR] Fail2ban fail to load the jail for $app" >&2
echo "WARNING${fail2ban_error#*WARNING}" >&2
fi
ynh_store_file_checksum "$finalfail2banjailconf"
ynh_store_file_checksum "$finalfail2banfilterconf"
systemctl restart fail2ban
local fail2ban_error="$(journalctl -u fail2ban | tail -n50 | grep "WARNING.*$app.*")"
if [ -n "$fail2ban_error" ]
then
echo "[ERR] Fail2ban failed to load the jail for $app" >&2
echo "WARNING${fail2ban_error#*WARNING}" >&2
fi
} }
# Remove the dedicated fail2ban config (jail and filter conf files) # Remove the dedicated fail2ban config (jail and filter conf files)
# #
# usage: ynh_remove_fail2ban_config # usage: ynh_remove_fail2ban_config
ynh_remove_fail2ban_config () { ynh_remove_fail2ban_config () {
ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf"
ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf"
sudo systemctl restart fail2ban
ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf"
ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf"
sudo systemctl restart fail2ban
} }
#================================================= #=================================================

Loading…
Cancel
Save