|
|
@ -63,55 +63,56 @@ ynh_delete_file_checksum () { |
|
|
# | arg: max_retry - Maximum number of retries allowed before banning IP address - default: 3 |
|
|
# | arg: max_retry - Maximum number of retries allowed before banning IP address - default: 3 |
|
|
# | arg: ports - Ports blocked for a banned IP address - default: http,https |
|
|
# | arg: ports - Ports blocked for a banned IP address - default: http,https |
|
|
ynh_add_fail2ban_config () { |
|
|
ynh_add_fail2ban_config () { |
|
|
# Process parameters |
|
|
|
|
|
logpath=$1 |
|
|
|
|
|
failregex=$2 |
|
|
|
|
|
max_retry=${3:-3} |
|
|
|
|
|
ports=${4:-http,https} |
|
|
|
|
|
|
|
|
|
|
|
test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing." |
|
|
|
|
|
test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing." |
|
|
|
|
|
|
|
|
|
|
|
finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf" |
|
|
|
|
|
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf" |
|
|
|
|
|
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1 |
|
|
|
|
|
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1 |
|
|
|
|
|
|
|
|
|
|
|
sudo tee $finalfail2banjailconf <<EOF |
|
|
|
|
|
|
|
|
# Process parameters |
|
|
|
|
|
logpath=$1 |
|
|
|
|
|
failregex=$2 |
|
|
|
|
|
max_retry=${3:-3} |
|
|
|
|
|
ports=${4:-http,https} |
|
|
|
|
|
|
|
|
|
|
|
test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing." |
|
|
|
|
|
test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing." |
|
|
|
|
|
|
|
|
|
|
|
finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf" |
|
|
|
|
|
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf" |
|
|
|
|
|
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1 |
|
|
|
|
|
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1 |
|
|
|
|
|
|
|
|
|
|
|
sudo tee $finalfail2banjailconf <<EOF |
|
|
[$app] |
|
|
[$app] |
|
|
enabled = true |
|
|
enabled = true |
|
|
port = $ports |
|
|
port = $ports |
|
|
filter = $app |
|
|
filter = $app |
|
|
logpath = $logpath |
|
|
logpath = $logpath |
|
|
maxretry = $max_retry" |
|
|
|
|
|
|
|
|
maxretry = $max_retry |
|
|
EOF |
|
|
EOF |
|
|
|
|
|
|
|
|
sudo tee $finalfail2banfilterconf <<EOF |
|
|
|
|
|
|
|
|
sudo tee $finalfail2banfilterconf <<EOF |
|
|
[INCLUDES] |
|
|
[INCLUDES] |
|
|
before = common.conf |
|
|
before = common.conf |
|
|
[Definition] |
|
|
[Definition] |
|
|
failregex = $failregex |
|
|
failregex = $failregex |
|
|
ignoreregrex =" |
|
|
|
|
|
|
|
|
ignoreregex = |
|
|
EOF |
|
|
EOF |
|
|
|
|
|
|
|
|
ynh_store_file_checksum "$finalfail2banjailconf" |
|
|
|
|
|
ynh_store_file_checksum "$finalfail2banfilterconf" |
|
|
|
|
|
|
|
|
|
|
|
sudo systemctl restart fail2ban |
|
|
|
|
|
if local fail2ban_error="$(tail -n50 /var/log/fail2ban.log | grep "WARNING Command.*$app.*addfailregex")" |
|
|
|
|
|
then |
|
|
|
|
|
echo "[ERR] Fail2ban fail to load the jail for $app" >&2 |
|
|
|
|
|
echo "WARNING${fail2ban_error#*WARNING}" >&2 |
|
|
|
|
|
fi |
|
|
|
|
|
|
|
|
ynh_store_file_checksum "$finalfail2banjailconf" |
|
|
|
|
|
ynh_store_file_checksum "$finalfail2banfilterconf" |
|
|
|
|
|
|
|
|
|
|
|
systemctl restart fail2ban |
|
|
|
|
|
local fail2ban_error="$(journalctl -u fail2ban | tail -n50 | grep "WARNING.*$app.*")" |
|
|
|
|
|
if [ -n "$fail2ban_error" ] |
|
|
|
|
|
then |
|
|
|
|
|
echo "[ERR] Fail2ban failed to load the jail for $app" >&2 |
|
|
|
|
|
echo "WARNING${fail2ban_error#*WARNING}" >&2 |
|
|
|
|
|
fi |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
# Remove the dedicated fail2ban config (jail and filter conf files) |
|
|
# Remove the dedicated fail2ban config (jail and filter conf files) |
|
|
# |
|
|
# |
|
|
# usage: ynh_remove_fail2ban_config |
|
|
# usage: ynh_remove_fail2ban_config |
|
|
ynh_remove_fail2ban_config () { |
|
|
ynh_remove_fail2ban_config () { |
|
|
ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf" |
|
|
|
|
|
ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf" |
|
|
|
|
|
sudo systemctl restart fail2ban |
|
|
|
|
|
|
|
|
ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf" |
|
|
|
|
|
ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf" |
|
|
|
|
|
sudo systemctl restart fail2ban |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
#================================================= |
|
|
#================================================= |
|
|
|