From 7e41f55ffdf769d5420d68f184f5a2d192c51baa Mon Sep 17 00:00:00 2001 From: Tanguy MAZE Date: Mon, 7 Jan 2019 13:29:32 +0100 Subject: [PATCH] fixed fail2ban not starting at 1st boot --- files/firewall.conf | 102 ++++++++++++++++++++------------------------ files/jail.local | 11 ----- files/jail.local2 | 25 +++++++++++ provision.yml | 13 ++++++ 4 files changed, 85 insertions(+), 66 deletions(-) create mode 100644 files/jail.local2 diff --git a/files/firewall.conf b/files/firewall.conf index f04ce42..d19b746 100644 --- a/files/firewall.conf +++ b/files/firewall.conf @@ -1,64 +1,56 @@ -# Generated by iptables-save v1.6.0 on Sun Jan 6 13:34:57 2019 -*raw -:PREROUTING ACCEPT [0:0] -:OUTPUT ACCEPT [8:590] -COMMIT -# Completed on Sun Jan 6 13:34:57 2019 -# Generated by iptables-save v1.6.0 on Sun Jan 6 13:34:57 2019 -*filter -:INPUT DROP [0:0] -:FORWARD DROP [0:0] -:OUTPUT DROP [32:2432] --A INPUT -p tcp -m multiport --dports 22,80,443 -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 --A INPUT -p tcp -m multiport --dports 22,80,443 -m tcp -m state --state INVALID -j DROP --A INPUT -p tcp -m connlimit --connlimit-above 40 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with tcp-reset --A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 10 -j ACCEPT --A INPUT -p tcp -m conntrack --ctstate NEW -j DROP --A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 --A INPUT -m conntrack --ctstate INVALID -j DROP --A INPUT -p tcp -m tcp --dport 2230 -j ACCEPT --A INPUT -p tcp -m tcp --dport 80 -j ACCEPT --A INPUT -p tcp -m tcp --dport 443 -j ACCEPT --A INPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT --A INPUT -p tcp -m tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT --A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT --A OUTPUT -p tcp -m tcp --sport 2230 -j ACCEPT --A OUTPUT -p tcp -m tcp --sport 80 -j ACCEPT --A OUTPUT -p tcp -m tcp --sport 443 -j ACCEPT --A OUTPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT --A OUTPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT --A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT --A INPUT -m recent --rcheck --seconds 86400 --name portscan --mask 255.255.255.255 --rsource -j DROP --A INPUT -m recent --remove --name portscan --mask 255.255.255.255 --rsource --A INPUT -p tcp -m multiport --dports 25,445,1433,3389 -m recent --set --name portscan --mask 255.255.255.255 --rsource -j DROP -COMMIT -# Completed on Sun Jan 6 13:34:57 2019 -# Generated by iptables-save v1.6.0 on Sun Jan 6 13:34:57 2019 +# Generated by iptables-save v1.6.0 on Mon Dec 10 17:46:32 2018 *mangle -:PREROUTING ACCEPT [63:103118] -:INPUT ACCEPT [63:103118] +:PREROUTING ACCEPT [356:24388] +:INPUT ACCEPT [356:24388] :FORWARD ACCEPT [0:0] -:OUTPUT ACCEPT [100:6885] -:POSTROUTING ACCEPT [68:4453] +:OUTPUT ACCEPT [246:65684] +:POSTROUTING ACCEPT [246:65684] -A PREROUTING -p icmp -j DROP -A PREROUTING -m conntrack --ctstate INVALID -j DROP --A PREROUTING -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP +-A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP -A PREROUTING -f -j DROP -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP -A PREROUTING -s 127.0.0.0/8 ! -i lo -j DROP -A PREROUTING -s 192.168.99.0/30 ! -i enp0s8 -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP --A PREROUTING -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP +-A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP +-A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP +-A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP +-A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP +-A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP +-A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP +-A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP +-A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP +-A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP +-A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP +-A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP +-A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP +-A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP COMMIT -# Completed on Sun Jan 6 13:34:57 2019 +# Completed on Mon Dec 10 17:46:32 2018 +# Generated by iptables-save v1.6.0 on Sat Nov 17 14:32:27 2018 +*filter +:INPUT DROP [0:0] +:FORWARD DROP [0:0] +:OUTPUT DROP [0:0] +-A INPUT -p tcp -m connlimit --connlimit-above 40 -j REJECT --reject-with tcp-reset +-A INPUT -p tcp -m conntrack --ctstate NEW -m limit --limit 60/s --limit-burst 10 -j ACCEPT +-A INPUT -p tcp -m conntrack --ctstate NEW -j DROP +-A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460 +-A INPUT -m conntrack --ctstate INVALID -j DROP +-A INPUT -p tcp -m tcp --dport 2230 -j ACCEPT +-A INPUT -p tcp --dport 80 -j ACCEPT +-A INPUT -p tcp --dport 443 -j ACCEPT +-A INPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT +-A INPUT -p tcp -m tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT +-A INPUT -p udp -m udp --sport 53 -m conntrack --ctstate ESTABLISHED -j ACCEPT +-A OUTPUT -p tcp -m tcp --sport 2230 -j ACCEPT +-A OUTPUT -p tcp --sport 80 -j ACCEPT +-A OUTPUT -p tcp --sport 443 -j ACCEPT +-A OUTPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT +-A OUTPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT +-A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT +-N port-scanning +-A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURN +-A port-scanning -j DROP +COMMIT +# Completed on Sat Nov 17 14:32:27 2018 diff --git a/files/jail.local b/files/jail.local index b85f743..467d3da 100644 --- a/files/jail.local +++ b/files/jail.local @@ -12,14 +12,3 @@ enabled = true [sshd-ddos] enabled = false -# -# HTTP servers -# - -[apache-auth] -enabled = true - -[apache-badbots] -# Ban hosts which agent identifies spammer robots crawling the web -# for email addresses. The mail outputs are buffered. -enabled = true diff --git a/files/jail.local2 b/files/jail.local2 new file mode 100644 index 0000000..b85f743 --- /dev/null +++ b/files/jail.local2 @@ -0,0 +1,25 @@ +# +# JAILS +# + +# +# SSH servers +# + +[sshd] +enabled = true + +[sshd-ddos] +enabled = false + +# +# HTTP servers +# + +[apache-auth] +enabled = true + +[apache-badbots] +# Ban hosts which agent identifies spammer robots crawling the web +# for email addresses. The mail outputs are buffered. +enabled = true diff --git a/provision.yml b/provision.yml index 20f1c98..767d93d 100644 --- a/provision.yml +++ b/provision.yml @@ -81,8 +81,21 @@ - name: "Activate ssl module" command: "a2enmod ssl" tags: [ "website" ] + - name: "Upload jail.local2" + copy: + src: "files/jail.local2" + dest: "/etc/fail2ban/jail.local" + owner: "root" + group: "root" + force: "yes" + tags: [ "website" ] - name: "Restart apache2" service: name: "apache2" state: "restarted" tags: [ "website" ] + - name: "Restart fail2ban" + service: + name: "fail2ban" + state: "restarted" + tags: [ "website" ]