diff --git a/AppendCMS.sh b/AppendCMS.sh index 07918b9..87380b7 100644 --- a/AppendCMS.sh +++ b/AppendCMS.sh @@ -234,4 +234,4 @@ fi ##-------## msg " Added CMS!" -bash /etc/update-motd.d/51* +if [ -f /etc/update-motd.d/51* ]; then bash /etc/update-motd.d/51*;fi \ No newline at end of file diff --git a/AppendModule.sh b/AppendModule.sh index fcdf7e7..8aec16d 100644 --- a/AppendModule.sh +++ b/AppendModule.sh @@ -259,4 +259,4 @@ done ##-------## msg " Added Module!" -bash /etc/update-motd.d/51* +if [ -f /etc/update-motd.d/51* ]; then bash /etc/update-motd.d/51*;fi diff --git a/CMS/nextcloud/conf.sh b/CMS/nextcloud/conf.sh index 59d4ffd..70201d3 100644 --- a/CMS/nextcloud/conf.sh +++ b/CMS/nextcloud/conf.sh @@ -9,4 +9,8 @@ mkdir /var/log/nextcloud chmod 774 -R /var/log/nextcloud ln -s /var/www/"$domain"/html/data/nextcloud.log /var/log/nextcloud/"$sitename" +#fail2ban +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/nextcloud_unconfigured -O /etc/fail2ban/jail.d/"$sitename"-nextcloud.local +sed -i 's/SITEname/'$sitename'/' /etc/fail2ban/jail.d/"$sitename"-nextcloud.local + systemctl reload php"$phpver"-fpm \ No newline at end of file diff --git a/CMS/wordpress/conf.sh b/CMS/wordpress/conf.sh index e94584e..11bb47b 100644 --- a/CMS/wordpress/conf.sh +++ b/CMS/wordpress/conf.sh @@ -39,6 +39,11 @@ useradd -g "$sitename" "$sitename" systemctl reload php"$phpver"-fpm +#fail2ban +if [ ! -f /etc/fail2ban/jail.d/wordpress-syslog.local ]; then + wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/Filters/wordpress-syslog.jail -O /etc/fail2ban/jail.d/wordpress-syslog.local +fi + #Setting Permsissions chown "$sitename":"$sitename" -R /var/www/"$domain"/html diff --git a/CoreModules/generic/apt.list b/CoreModules/generic/apt.list index 5310725..d084b57 100644 --- a/CoreModules/generic/apt.list +++ b/CoreModules/generic/apt.list @@ -1 +1 @@ -mailutils htop ufw nload \ No newline at end of file +mailutils htop ufw nload fail2ban \ No newline at end of file diff --git a/CoreModules/generic/conf.sh b/CoreModules/generic/conf.sh index f61926e..b3a227e 100644 --- a/CoreModules/generic/conf.sh +++ b/CoreModules/generic/conf.sh @@ -13,24 +13,6 @@ root: $email EOF newaliases - -##------------## -# Fail2Ban # -##------------## - -##Disabled -#sed -i 's/root@localhost/'$email'/g' /etc/fail2ban/jail.conf -#wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/sshd.local -O /etc/fail2ban/jail.d/sshd.local -#if [[ $CMS == "Nextcloud" ]]; then -#wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/nextcloud.conf -O /etc/fail2ban/filter.d/nextcloud.conf -#wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/nextcloud.local -O /etc/fail2ban/jail.d/nextcloud.local -#fi -#if [[ $CMS == "Wordpress" ]]; then -#wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/wordpress.conf -O /etc/fail2ban/filter.d/wordpress.conf -#wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/wordpress.local -O /etc/fail2ban/jail.d/wordpress.local -#fi - - ##-------## # UFW # ##-------## @@ -41,4 +23,21 @@ ufw default allow outgoing > $OUTPUT 2>&1 ufw allow 80/tcp > $OUTPUT 2>&1 ufw allow 443/tcp > $OUTPUT 2>&1 ufw limit 4242/tcp > $OUTPUT 2>&1 -echo "y" | ufw enable > $OUTPUT 2>&1 \ No newline at end of file +echo "y" | ufw enable > $OUTPUT 2>&1 + +##------------## +# Fail2Ban # +##------------## + +#General config +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/jail.local -O /etc/fail2ban/jail.local + +#Custom Fiters +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/Filters/nextcloud.filter -O /etc/fail2ban/filter.d/nextcloud.local +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/Filters/phpmyadmin-authlog.filter -O /etc/fail2ban/filter.d/phpmyadmin-authlog.local +wget -q -t7 https://plugins.svn.wordpress.org/wp-fail2ban/trunk/filters.d/wordpress-hard.conf -O /etc/fail2ban/filter.d/wordpress-hard.local +wget -q -t7 https://plugins.svn.wordpress.org/wp-fail2ban/trunk/filters.d/wordpress-soft.conf -O /etc/fail2ban/filter.d/wordpress-soft.local + +#General jails +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/sshd.jail -O /etc/fail2ban/jail.d/sshd.local +wget -q -t7 "$repo"/raw/branch/"$branch"/config/fail2ban/phpmyadmin.jail -O /etc/fail2ban/jail.d/phpmyadmin.local \ No newline at end of file diff --git a/config/fail2ban/Filters/nextcloud.filter b/config/fail2ban/Filters/nextcloud.filter new file mode 100644 index 0000000..3c39c0d --- /dev/null +++ b/config/fail2ban/Filters/nextcloud.filter @@ -0,0 +1,4 @@ +[Definition] +_groupsre = (?:(?:,?\s*"\w+":(?:"[^"]+"|\w+))*) +failregex = ^\{%(_groupsre)s,?\s*"remoteAddr":""%(_groupsre)s,?\s*"message":"Login failed: +datepattern = ,?\s*"time"\s*:\s*"%%Y-%%m-%%d[T ]%%H:%%M:%%S(%%z)?" diff --git a/config/fail2ban/Filters/phpmyadmin-authlog.filter b/config/fail2ban/Filters/phpmyadmin-authlog.filter new file mode 100644 index 0000000..597db21 --- /dev/null +++ b/config/fail2ban/Filters/phpmyadmin-authlog.filter @@ -0,0 +1,11 @@ +# Fail2Ban filter for the phpMyAdmin-Authlog +# + +[INCLUDES] + +before = common.conf + +[Definition] + +failregex = ^%(__prefix_line)suser denied: (?:\S+|.*?) \(mysql-denied\) from \s*$ + diff --git a/config/fail2ban/Jails/nextcloud_unconfigured b/config/fail2ban/Jails/nextcloud_unconfigured new file mode 100644 index 0000000..1f45406 --- /dev/null +++ b/config/fail2ban/Jails/nextcloud_unconfigured @@ -0,0 +1,9 @@ +[nextcloud_SITEname] +enabled = true +port = http,https +protocol = tcp +filter = nextcloud +maxretry = 20 +bantime = 900 +findtime = 900 +logpath = /var/log/nextcloud/SITEname diff --git a/config/fail2ban/Jails/nginx-Basic-auth_unconfigured b/config/fail2ban/Jails/nginx-Basic-auth_unconfigured new file mode 100644 index 0000000..caf4c08 --- /dev/null +++ b/config/fail2ban/Jails/nginx-Basic-auth_unconfigured @@ -0,0 +1,5 @@ +[nginx-auth-SITEname] +enabled = true +filter = nginx-http-auth +port = http,https +logpath = /var/log/nginx/SITEname-error.log diff --git a/config/fail2ban/Jails/phpmyadmin.jail b/config/fail2ban/Jails/phpmyadmin.jail new file mode 100644 index 0000000..316a22c --- /dev/null +++ b/config/fail2ban/Jails/phpmyadmin.jail @@ -0,0 +1,5 @@ +[phpmyadmin] +enabled = true +port = http,https +filter = phpmyadmin-authlog +logpath = /var/log/PhpMyAdmin/PhpMyAdmin_auth.log diff --git a/config/fail2ban/Jails/sshd-jail.jail b/config/fail2ban/Jails/sshd-jail.jail new file mode 100644 index 0000000..9eb356c --- /dev/null +++ b/config/fail2ban/Jails/sshd-jail.jail @@ -0,0 +1,2 @@ +[sshd] +enabled = true diff --git a/config/fail2ban/Jails/wordpress-syslog.jail b/config/fail2ban/Jails/wordpress-syslog.jail new file mode 100644 index 0000000..d8cba6c --- /dev/null +++ b/config/fail2ban/Jails/wordpress-syslog.jail @@ -0,0 +1,11 @@ +[wordpress-hard] +enabled = true +filter = wordpress-hard +logpath = /var/log/auth.log +port = http,https + +[wordpress-soft] +enabled = true +filter = wordpress-soft +logpath = /var/log/auth.log +port = http,https diff --git a/config/fail2ban/jail.local b/config/fail2ban/jail.local new file mode 100644 index 0000000..0d117fa --- /dev/null +++ b/config/fail2ban/jail.local @@ -0,0 +1,53 @@ +[DEFAULT] +# External command that will take an tagged arguments to ignore, e.g. , +# and return true if the IP is to be ignored. False otherwise. +# +# ignorecommand = /path/to/command +ignorecommand = + +# "bantime" is the number of seconds that a host is banned. +bantime = 10m + +# A host is banned if it has generated "maxretry" during the last "findtime" +# seconds. +findtime = 10m + +# "maxretry" is the number of failures before a host get banned. +maxretry = 5 + +backend = auto + + + +# +# ACTIONS +# + +# Some options used for actions + +# Destination email address used solely for the interpolations in +# jail.{conf,local,d/*} configuration files. +destemail = root@localhost + +# Sender email address used solely for some actions +sender = root@ + +# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the +# mailing. Change mta configuration parameter to mail if you want to +# revert to conventional 'mail'. +mta = sendmail + +# Default protocol +protocol = tcp + +# Specify chain where jumps would need to be added in ban-actions expecting parameter chain +chain = + +# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3 +fail2ban_agent = Fail2Ban/%(fail2ban_version)s + +# +# Action shortcuts. To be used to define action parameter + +banaction = ufw +banaction_allports = ufw diff --git a/config/fail2ban/nextcloud.conf b/config/fail2ban/nextcloud.conf deleted file mode 100644 index 46235b1..0000000 --- a/config/fail2ban/nextcloud.conf +++ /dev/null @@ -1,4 +0,0 @@ -[Definition] -failregex=^{"reqId":".","remoteAddr":".","app":"core","message":"Login failed: '.' (Remote IP: '')","level":2,"time":"."}$ - ^{"reqId":".","level":2,"time":".","remoteAddr":".","app":"core".","message":"Login failed: '.' (Remote IP: '')".}$ - ^.\"remoteAddr\":\"\".Trusted domain error.*$ \ No newline at end of file diff --git a/config/fail2ban/nextcloud.local b/config/fail2ban/nextcloud.local deleted file mode 100644 index cb56603..0000000 --- a/config/fail2ban/nextcloud.local +++ /dev/null @@ -1,11 +0,0 @@ -[nextcloud] -ignoreip = 192.168.1.0/24 -backend = auto -enabled = true -port = 80,443 -protocol = tcp -filter = nextcloud -maxretry = 3 -bantime = 36000 -findtime = 36000 -logpath = /var/nextcloud/data/nextcloud.log \ No newline at end of file diff --git a/config/fail2ban/sshd.local b/config/fail2ban/sshd.local deleted file mode 100644 index fa86e4f..0000000 --- a/config/fail2ban/sshd.local +++ /dev/null @@ -1,6 +0,0 @@ -[sshd] -enabled = true -port = 4242 -filter = sshd -logpath = /var/log/auth.log -maxretry = 5 \ No newline at end of file diff --git a/config/fail2ban/wordpress.conf b/config/fail2ban/wordpress.conf deleted file mode 100644 index f761e09..0000000 --- a/config/fail2ban/wordpress.conf +++ /dev/null @@ -1,2 +0,0 @@ -[Definition] -failregex = <HOST>.*POST.*(wp-login\.php|xmlrpc\.php).* 200 \ No newline at end of file diff --git a/config/fail2ban/wordpress.local b/config/fail2ban/wordpress.local deleted file mode 100644 index 2a66baa..0000000 --- a/config/fail2ban/wordpress.local +++ /dev/null @@ -1,7 +0,0 @@ -[wordpress] -enabled = true -port = http,https -filter = wordpress -logpath = /var/log/nginx/access.log -maxretry = 10 -bantime = 3600 \ No newline at end of file diff --git a/installer.sh b/installer.sh index f2c964d..7ec9543 100644 --- a/installer.sh +++ b/installer.sh @@ -579,4 +579,4 @@ systemctl reload sshd postfix postfix@- ##-------## msg " Done installing!" -bash /etc/update-motd.d/51* +if [ -f /etc/update-motd.d/51* ]; then bash /etc/update-motd.d/51*;fi