Subversion Repositories ALCASAR

Rev

Rev 3230 | Show entire file | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 3230 Rev 3231
Line 1... Line 1...
1 
#!/bin/bash
 1 
#!/bin/bash
2 
#  $Id: alcasar.sh 3230 2024-11-06 23:38:15Z rexy $
 2 
#  $Id: alcasar.sh 3231 2024-11-10 23:12:08Z rexy $
3 
 
 3 
 
4 
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
 4 
# ALCASAR is a Free and open source NAC (Network Access Controler) created by Franck BOUIJOUX (3abtux), Pascal LEVANT and Richard REY (Rexy)
5 
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
 5 
# ALCASAR is based on a stripped Mageia (LSB) with the following open source softwares Coovachilli, freeradius, mariaDB, apache, php, netfilter, e2guardian, ntpd, openssl, unbound, gammu, Ulog, fail2ban, vnstat, wkhtml2pdf, ipt_NETFLOW, NFsen and NFdump
6 
# contact : info@alcasar.net
 6 
# contact : info@alcasar.net
7 
 
 7 
 
Line 1898... Line 1898...
1898 
} # End of cron()
 1898 
} # End of cron()
1899 
 
 1899 
 
1900 
########################################################################
 1900 
########################################################################
1901 
##                              "Fail2Ban"                            ##
 1901 
##                              "Fail2Ban"                            ##
1902 
##- Adapt conf file to ALCASAR                                        ##
 1902 
##- Adapt conf file to ALCASAR                                        ##
1903 
##- Secure items : DDOS, SSH-Brute-Force, Intercept & ACC brute-Force ##
 1903 
##- Secure items : SSH, intercept & ACC brute-Force + evasive + pwd   ##
1904 
########################################################################
 1904 
########################################################################
1905 
fail2ban()
 1905 
fail2ban()
1906 
{
 1906 
{
1907 
# adapt fail2ban to Mageia (fedora like) & ALCASAR behaviour
 1907 
# adapt fail2ban to Mageia (fedora like) & ALCASAR behaviour
1908 
	[ -e /etc/fail2ban/jail.conf.default ] || cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.default
 1908 
	[ -e /etc/fail2ban/jail.conf.default ] || cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.default
1909 
	$SED "s?^before =.*?before = paths-mageia.conf?g" /etc/fail2ban/jail.conf
 1909 
	$SED "s?^before =.*?before = paths-mageia.conf?g" /etc/fail2ban/jail.conf
1910 
 
 1910 
 
1911 
# add 5 jails and their filters
 1911 
# add 5 jails and their filters
1912 
## sshd : Ban after 3 failed attempts (ie. brute-force). This "jail" uses the default "sshd" f2b filter.
 1912 
## sshd : Ban after 5 failed attempts (ie. brute-force). This "jail" uses the default "sshd" f2b filter.
1913 
	cat << EOF > /etc/fail2ban/jail.d/01-alcasar_sshd.conf
 1913 
	cat << EOF > /etc/fail2ban/jail.d/01-alcasar_sshd.conf
1914 
[sshd]
 1914 
[sshd]
1915 
enabled = true
 1915 
enabled = true
1916 
#enabled  = false
 1916 
#enabled  = false
1917 
maxretry = 3
 1917 
maxretry = 5
1918 
bantime = 3m
 1918 
bantime = 3m
1919 
findtime = 5m
 1919 
findtime = 3m
1920 
EOF
 1920 
EOF
1921 
 
 1921 
 
1922 
## lighttpd-auth : Ban after 3 failed attempts on ACC. This "jail" uses the default "lighttpd-auth" f2b filter.
 1922 
## alcasar_httpd-auth : Ban after 3 failed attempts on ACC. This "jail" uses the default "apache-auth" f2b filter.
1923 
#	cat << EOF > /etc/fail2ban/jail.d/02-alcasar_lighttpd-auth.conf
 1923 
	cat << EOF > /etc/fail2ban/jail.d/02-alcasar_httpd-auth.conf
1924 
#[lighttpd-auth]
 1924 
[apache-auth]
1925 
#enabled = true
 1925 
enabled = true
1926 
#enabled  = false
 1926 
#enabled  = false
1927 
#maxretry = 3
 1927 
maxretry = 3
1928 
#bantime = 3m
 1928 
bantime = 3m
1929 
#findtime = 3m
 1929 
findtime = 3m
1930 
#EOF
 1930 
EOF
1931 
 
 1931 
 
1932 
## mod-evasive : Ban after 3 failed retrieve page attempts (ie : unknown page)
 1932 
## mod-evasive : Ban after 3 failed retrieve page attempts (ie : unknown page)
1933 
	cat << EOF > /etc/fail2ban/jail.d/03-alcasar_mod-evasive.conf
 1933 
	cat << EOF > /etc/fail2ban/jail.d/03-alcasar_mod-evasive.conf
1934 
[alcasar_mod-evasive]
 1934 
[alcasar_mod-evasive]
1935 
#enabled = true
 1935 
enabled = true
1936 
enabled = false
 1936 
#enabled = false
1937 
backend = auto
 1937 
backend = auto
1938 
filter = alcasar_mod-evasive
 1938 
filter = alcasar_mod-evasive
1939 
action = iptables-allports[name=alcasar_mod-evasive]
 1939 
action = iptables-allports[name=alcasar_mod-evasive]
1940 
logpath = /var/log/httpd/access.log
 1940 
logpath = /var/log/httpd/access_log
1941 
maxretry = 3
 1941 
maxretry = 3
1942 
bantime = 3m
 1942 
bantime = 3m
1943 
findtime = 3m
 1943 
findtime = 3m
1944 
EOF
 1944 
EOF
1945 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_mod-evasive.conf
 1945 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_mod-evasive.conf
Line 1954... Line 1954...
1954 
enabled = true
 1954 
enabled = true
1955 
#enabled = false
 1955 
#enabled = false
1956 
backend = auto
 1956 
backend = auto
1957 
filter = alcasar_intercept
 1957 
filter = alcasar_intercept
1958 
action = iptables-allports[name=alcasar_intercept]
 1958 
action = iptables-allports[name=alcasar_intercept]
1959 
logpath = /var/log/httpd/access.log
 1959 
logpath = /var/log/httpd/access_log
1960 
maxretry = 5
 1960 
maxretry = 5
1961 
bantime = 3m
 1961 
bantime = 3m
1962 
findtime = 3m
 1962 
findtime = 3m
1963 
EOF
 1963 
EOF
1964 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_intercept.conf
 1964 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_intercept.conf
Line 1973... Line 1973...
1973 
enabled = true
 1973 
enabled = true
1974 
#enabled = false
 1974 
#enabled = false
1975 
backend = auto
 1975 
backend = auto
1976 
filter = alcasar_change-pwd
 1976 
filter = alcasar_change-pwd
1977 
action = iptables-allports[name=alcasar_change-pwd]
 1977 
action = iptables-allports[name=alcasar_change-pwd]
1978 
logpath = /var/log/httpd/access.log
 1978 
logpath = /var/log/httpd/access_log
1979 
maxretry = 5
 1979 
maxretry = 5
1980 
bantime = 3m
 1980 
bantime = 3m
1981 
findtime = 3m
 1981 
findtime = 3m
1982 
EOF
 1982 
EOF
1983 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_change-pwd.conf
 1983 
	cat << EOF > /etc/fail2ban/filter.d/alcasar_change-pwd.conf