diff --git a/app/Commands/Fail2banCommand.php b/app/Commands/Fail2banCommand.php deleted file mode 100644 index 1a42e9d..0000000 --- a/app/Commands/Fail2banCommand.php +++ /dev/null @@ -1,51 +0,0 @@ -line('kk'); - - if ($configuration) { - $this->error('Configuration...not found!'); - } else { - - - exec('service fail2ban restart'); - } - } -} diff --git a/app/Commands/Fail2banDisableCommand.php b/app/Commands/Fail2banDisableCommand.php new file mode 100644 index 0000000..4006884 --- /dev/null +++ b/app/Commands/Fail2banDisableCommand.php @@ -0,0 +1,55 @@ +argument('configuration'); + + $source = base_path().self::RESOURCES_JAIL_DIRECTORY.'/'.$configuration.'.conf'; + + // configuration not found + if (!file_exists($source)) { + $this->error('fail2ban...configuration not found'); + exit(); + } + + unlink(self::FAIL2BAN_JAIL_DIRECTORY.'/'.$configuration.'.conf'); + + exec('service fail2ban restart'); + $this->info('fail2ban...'.$configuration.' disabled'); + } +} diff --git a/app/Commands/Fail2banEnableCommand.php b/app/Commands/Fail2banEnableCommand.php new file mode 100644 index 0000000..0e1e3c6 --- /dev/null +++ b/app/Commands/Fail2banEnableCommand.php @@ -0,0 +1,59 @@ +argument('configuration'); + + $source = base_path().self::RESOURCES_JAIL_DIRECTORY.'/'.$configuration.'.conf'; + + // configuration not found + if (!file_exists($source)) { + $this->error('fail2ban...configuration not found'); + exit(); + } + + $destination = self::FAIL2BAN_JAIL_DIRECTORY.'/'.$configuration.'.conf'; + + copy($source, $destination); + $this->info('fail2ban...'.$configuration.' enabled'); + + exec('service fail2ban restart'); + } +} diff --git a/install.sh b/install.sh index 0a387dd..c67a19d 100755 --- a/install.sh +++ b/install.sh @@ -50,6 +50,8 @@ filter = sshd logpath = /var/log/auth-fail2ban.log EOF +cp resources/fail2ban/filter.d/* /etc/fail2ban/filter.d +touch /var/log/fail2ban.log service fail2ban start echo -e "MCP installed" \ No newline at end of file diff --git a/resources/fail2ban/filter.d/gitea-auth.conf b/resources/fail2ban/filter.d/gitea-auth.conf new file mode 100644 index 0000000..2d1784f --- /dev/null +++ b/resources/fail2ban/filter.d/gitea-auth.conf @@ -0,0 +1,3 @@ +[Definition] +failregex = .*Failed authentication attempt for .* from +ignoreregex = \ No newline at end of file diff --git a/resources/fail2ban/filter.d/woocommerce-auth.conf b/resources/fail2ban/filter.d/woocommerce-auth.conf new file mode 100644 index 0000000..3f7fc5c --- /dev/null +++ b/resources/fail2ban/filter.d/woocommerce-auth.conf @@ -0,0 +1,8 @@ +# woocommerce auth failed + +[INCLUDES] +before = common.conf + +[Definition] +failregex = .*POST.*(/account/).* 200 +ignoreregex = \ No newline at end of file diff --git a/resources/fail2ban/filter.d/wordpress-auth.conf b/resources/fail2ban/filter.d/wordpress-auth.conf new file mode 100644 index 0000000..6897b22 --- /dev/null +++ b/resources/fail2ban/filter.d/wordpress-auth.conf @@ -0,0 +1,8 @@ +# wordpress login failed + +[INCLUDES] +before = common.conf + +[Definition] +failregex = .*POST.*(wp-login\.php|xmlrpc\.php).* 200 +ignoreregex = \ No newline at end of file diff --git a/resources/fail2ban/jail.d/gitea.conf b/resources/fail2ban/jail.d/gitea.conf new file mode 100644 index 0000000..9473a98 --- /dev/null +++ b/resources/fail2ban/jail.d/gitea.conf @@ -0,0 +1,9 @@ +# + +[gitea] + +enabled = true +filter = gitea +port = http,https +logpath = /var/lib/gitea/log/gitea.log +maxretry = 3 diff --git a/resources/fail2ban/jail.d/nginx-badbots.conf b/resources/fail2ban/jail.d/nginx-badbots.conf new file mode 100644 index 0000000..07f5d11 --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-badbots.conf @@ -0,0 +1,9 @@ +# stop some known malicious bot request patterns + +[nginx-badbots] + +enabled = true +port = http,https +filter = apache-badbots +logpath = /var/log/nginx/*access.log +maxretry = 2 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/nginx-botsearch.conf b/resources/fail2ban/jail.d/nginx-botsearch.conf new file mode 100644 index 0000000..c3b73a0 --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-botsearch.conf @@ -0,0 +1,7 @@ +[nginx-botsearch] + +enabled = true +port = http,https +filter = nginx-botsearch +logpath = /var/log/nginx/*access.log +maxretry = 2 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/nginx-http-auth.conf b/resources/fail2ban/jail.d/nginx-http-auth.conf new file mode 100644 index 0000000..da27e33 --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-http-auth.conf @@ -0,0 +1,9 @@ +# ban clients that are searching for scripts on the website to execute and exploit, +# only using if php not in use + +[nginx-http-auth] + +enabled = true +filter = nginx-http-auth +port = http,https +logpath = /var/log/nginx/*error.log \ No newline at end of file diff --git a/resources/fail2ban/jail.d/nginx-nohome.conf b/resources/fail2ban/jail.d/nginx-nohome.conf new file mode 100644 index 0000000..b0e74cb --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-nohome.conf @@ -0,0 +1,7 @@ +[nginx-nohome] + +enabled = true +port = http,https +filter = apache-nohome +logpath = /var/log/nginx/*access.log +maxretry = 2 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/nginx-noscript.conf b/resources/fail2ban/jail.d/nginx-noscript.conf new file mode 100644 index 0000000..6bce704 --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-noscript.conf @@ -0,0 +1,7 @@ +[nginx-noscript] + +enabled = true +port = http,https +filter = apache-noscript +logpath = /var/log/nginx/*access.log +maxretry = 2 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/nginx-req-limit.conf b/resources/fail2ban/jail.d/nginx-req-limit.conf new file mode 100644 index 0000000..ec77bb3 --- /dev/null +++ b/resources/fail2ban/jail.d/nginx-req-limit.conf @@ -0,0 +1,10 @@ +# dos + +[nginx-req-limit] + +enabled = true +filter = nginx-req-limit +logpath = /var/log/nginx/*error.log +findtime = 600 +bantime = 7200 +maxretry = 10 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/woocommerce.conf b/resources/fail2ban/jail.d/woocommerce.conf new file mode 100644 index 0000000..1c2128c --- /dev/null +++ b/resources/fail2ban/jail.d/woocommerce.conf @@ -0,0 +1,9 @@ +# + +[woocommerce] + +enabled = true +port = http,https +filter = woocommerce-auth +logpath = /var/log/nginx/*access.log +maxretry = 3 \ No newline at end of file diff --git a/resources/fail2ban/jail.d/wordpress.conf b/resources/fail2ban/jail.d/wordpress.conf new file mode 100644 index 0000000..f920c87 --- /dev/null +++ b/resources/fail2ban/jail.d/wordpress.conf @@ -0,0 +1,7 @@ +[wordpress] + +enabled = true +port = http,https +filter = wordpress-auth +logpath = /var/log/nginx/*access.log +maxretry = 3 \ No newline at end of file