WebSVN – ALCASAR – Diff – /conf/fail2ban.sh

+#!/bin/sh
+# $Id: fail2ban.sh 2271 2017-06-04 18:45:27Z tom.houdayer $
 FAIL_CONF="/etc/fail2ban/fail2ban.conf"
 JAIL_CONF="/etc/fail2ban/jail.conf"
 DIR_FILTER="/etc/fail2ban/filter.d/"
 ACTION_ALLPORTS="/etc/fail2ban/action.d/iptables-allports.conf"
 #########################################################
 ## Mise à jour du fichier de configuration de fail2ban ##
 #########################################################
-if(test -f $FAIL_CONF)
-then
-	mv $FAIL_CONF $FAIL_CONF.default
+[ -f $FAIL_CONF ] && [ ! -e $FAIL_CONF.default ] && mv $FAIL_CONF $FAIL_CONF.default
-fi
 cat << EOF > $FAIL_CONF
 [Definition]
 # Option:  loglevel
 EOF
 #########################################################
 ## Mise à jour de la configuration de jail de fail2ban ##
 #########################################################
-if(test -f $JAIL_CONF)
-then
-	mv $JAIL_CONF $JAIL_CONF.default
+[ -f $JAIL_CONF ] && [ ! -e $JAIL_CONF.default ] && mv $JAIL_CONF $JAIL_CONF.default
-fi
 cat << EOF > $JAIL_CONF
 # Fail2Ban configuration file
+#
 # Author: Cyril Jaquier
 #enabled = true
 enabled = false
 filter = alcasar_mod-evasive
 action = iptables-allports[name=alcasar_mod-evasive]
 logpath = /var/log/httpd/error_log
+          /var/log/httpd/ssl_error_log
 maxretry = 2
 # Bannissement sur tout les ports après 3 refus de SSH (tentative d'accès par brute-force)
 [ssh-iptables]
 action   = iptables-allports[name=SSH]
 logpath  = /var/log/auth.log
 maxretry = 3
 # Bannissement sur tous les ports après 5 échecs de connexion sur le centre de contrôle (ACC)
-[alcasar_htdigest]
+[alcasar_acc-htdigest]
 enabled = true
 #enabled = false
-filter = alcasar_htdigest
+filter = alcasar_acc-htdigest
-action = iptables-allports[name=alcasar_htdigest]
+action = iptables-allports[name=alcasar_acc-htdigest]
-logpath = /var/log/httpd/ssl_request_log
+logpath = /var/log/httpd/ssl_error_log
 maxretry = 5
 # Bannissement sur tout les ports après 5 echecs de connexion pour un usager
 [alcasar_intercept]
 EOF
 ##################################################
 ## Mise en place des filtres spécifiques	##
 ## - Mod_evasive.conf				##
-## - htdigest.conf                      	##
+## - acc-htdigest.conf				##
 ## - intercept.conf				##
-## - mot de passe				##
+## - change-pwd.conf				##
 ##################################################
 ######################
 ## MOD-EVASIVE.CONF ##
 ######################
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
+#
-failregex = [[]client <HOST>[]] client denied by server configuration
+failregex =  \[client <HOST>:[0-9]+\] .*client denied by server configuration
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
+#
 ignoreregex =
 EOF
-###################
+#######################
-## HTDIGEST.CONF ##
+## ACC-HTDIGEST.CONF ##
-###################
+#######################
-cat << EOF > $DIR_FILTER/alcasar_htdigest.conf
+cat << EOF > $DIR_FILTER/alcasar_acc-htdigest.conf
 # Fail2Ban configuration file
+#
 # Author: Cyril Jaquier
 # Adapted by ALCASAR team
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
+#
-#failregex = [[]error[]] [[]client <HOST>[]] Digest:
+failregex =  \[auth_digest:error\] \[client <HOST>:[0-9]+\] .*ALCASAR Control Center \(ACC\)
-failregex = [[]<HOST>[]] "GET /acc HTTP/1.1" 972
 #[[]auth_digest:error[]] [[]client <HOST>:[0-9]\{1,5\}[]]
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
+#
-#failregex = <HOST> TLSv1 DHE-RSA-AES256-SHA ["]GET \/intercept\.php\?res=failed[&]reason=reject
-failregex = [[]<HOST>[]] ["]GET \/intercept\.php\?res=failed[&]reason=reject
+failregex = \[<HOST>\] \"GET \/intercept\.php\?res=failed\&reason=reject
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
+#
 ignoreregex =
 EOF
-#######################
+#####################
-## MOT_DE_PASSE.CONF ##
+## CHANGE-PWD.CONF ##
-#######################
+#####################
 cat << EOF > $DIR_FILTER/alcasar_change-pwd.conf
 # Fail2Ban configuration file
+#
 # Author: Cyril Jaquier
 #          host must be matched by a group named "host". The tag "<HOST>" can
 #          be used for standard IP/hostname matching and is only an alias for
 #          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
 # Values:  TEXT
+#
-#failregex = <HOST> TLSv1 DHE-RSA-AES256-SHA ["]POST \/pass\/index\.php HTTP
-failregex = [[]<HOST>[]] ["]POST /pass/index.php HTTP/1.1" 11169
+failregex = \[<HOST>\] \"POST \/pass
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.
 # Values:  TEXT
 EOF
 ##############################################
 ##   Log sur ULOG quand iptables-allports   ##
 ##############################################
-if ( test -f $ACTION_ALLPORTS )
-then
-	mv $ACTION_ALLPORTS $ACTION_ALLPORTS.default
+[ -f $ACTION_ALLPORTS ] && [ ! -e $ACTION_ALLPORTS.default ] && mv $ACTION_ALLPORTS $ACTION_ALLPORTS.default
-fi
 cat << EOF > $ACTION_ALLPORTS
 # Fail2Ban configuration file
+#
 # Author: Cyril Jaquier
 # Modified: Yaroslav O. Halchenko <debian@onerussian.com>
 #          <failures>  number of failures
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
 actionban = iptables -I fail2ban-<name> 1 -s <ip> -j ULOG --ulog-prefix "Fail2Ban -- DROP"
-	    iptables -I fail2ban-<name> 1 -s <ip> -j DROP
+            iptables -I fail2ban-<name> 1 -s <ip> -j DROP
 # Option:  actionunban
 # Notes.:  command executed when unbanning an IP. Take care that the
 #          command is executed with Fail2Ban user rights.
 # Tags:    <ip>  IP address
 #          <failures>  number of failures
 #          <time>  unix timestamp of the ban time
 # Values:  CMD
+#
 actionunban = iptables -D fail2ban-<name> -s <ip> -j DROP
-	      iptables -D fail2ban-<name> -s <ip> -j ULOG --ulog-prefix "Fail2Ban -- DROP"
+              iptables -D fail2ban-<name> -s <ip> -j ULOG --ulog-prefix "Fail2Ban -- DROP"
 [Init]
 # Defaut name of the chain
+#

Subversion Repositories ALCASAR

(root)/conf/fail2ban.sh @ 2271 – Rev 1410 → 2271