À tous ceux qui utilisent le fail2ban intégré à SWAG.
J'ai un soucis, aucun de mes fichier .local dans le dossier jail.d n'est pris en compte...
Seul ce que j'ai mis dans le jail.local est pris en compte.
Comment ça se fait ?
Voilà ce que j'ai dans mon jail.local :
Et exemple de fichier pour vaulwarden dans jail.d :
Merci pour le coup de main
J'ai un soucis, aucun de mes fichier .local dans le dossier jail.d n'est pris en compte...
Seul ce que j'ai mis dans le jail.local est pris en compte.
Comment ça se fait ?
Voilà ce que j'ai dans mon jail.local :
INI:
## Version 2020/05/10 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/jail.local
# This is the custom version of the jail.conf for fail2ban
# Feel free to modify this and add additional filters
# Then you can drop the new filter conf files into the fail2ban-filters
# folder and restart the container
##==============================================================================================
## ##
## Sources utilisées pour personnaliser ce fichier et ceux dans les sous-dossiers ##
## https://www.linode.com/docs/guides/using-fail2ban-to-secure-your-server-a-tutorial/ ##
## ##
## https://www.linuxtricks.fr/wiki/print.php?id=40 ##
## ##
##==============================================================================================
[DEFAULT]
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
# ban a host which matches an address in this list. Several addresses can be
# defined using space separator.
ignoreip = 127.0.0.1/8 ::1
10.0.0.0/8
192.168.0.0/16
172.16.0.0/12
# Changes the default ban action from "iptables-multiport", which causes issues on some platforms, to "iptables-allports".
banaction = %(banaction_allports)s
# "bantime.increment" allows to use database for searching of previously banned ip's to increase a
# default ban time
bantime.increment = true
# "bantime.maxtime" is the max number of seconds using the ban time can reach (doesn't grow further)
bantime.maxtime = 5w
# "bantime.factor" is a coefficient to calculate exponent growing of the formula or common multiplier
bantime.factor = 24
# "bantime" is the number of seconds that a host is banned.
bantime = 1h
# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime = 24h
# "maxretry" is the number of failures before a host get banned.
maxretry = 5
# ########################################
# eMail config
destemail = mon-email@gmail.com
dest = mon-email@gmail.com
sender = mon-email@gmail.com
sendername = Fail2Ban (SWAG)
# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action = %(action_mwl)s
# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
actionstart = printf %%b "Subject: [Fail2Ban (SWAG)] <name>: started on <fq-hostname>
Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
From: <sendername> <<sender>>
To: <dest>\n
Hi,\n
The jail <name> has been started successfully.\n
Regards,\n
Fail2Ban (SWAG)" | <mailcmd>
# Notes.: command executed at the stop of jail (or at the end of Fail2Ban)
actionstop = printf %%b "Subject: [Fail2Ban (SWAG)] <name>: stopped on <fq-hostname>
Date: `LC_ALL=C date +"%%a, %%d %%h %%Y %%T %%z"`
From: <sendername> <<sender>>
To: <dest>\n
Hi,\n
The jail <name> has been stopped.\n
Regards,\n
Fail2Ban (SWAG)" | <mailcmd>
# ########################################
backend = auto
[ssh]
enabled = true
port = 99 # Valeur du port si changer, sinon ssh
filter = sshd
logpath = /log/host_ssh_auth.log
[nginx-http-auth]
enabled = true
filter = nginx-http-auth
port = http,https
logpath = /config/log/nginx/error.log
[nginx-badbots]
enabled = true
port = http,https
filter = nginx-badbots
logpath = /config/log/nginx/access.log
maxretry = 2
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /config/log/nginx/access.log
[nginx-deny]
enabled = false
port = http,https
filter = nginx-deny
logpath = /config/log/nginx/error.log
[nginx-unauthorized]
enabled = true
port = http,https
filter = nginx-unauthorized
logpath = /config/log/nginx/unauthorized.logEt exemple de fichier pour vaulwarden dans jail.d :
INI:
## /volume1/docker/swag_macvlan/fail2ban/jail.d/vaultwarden-auth.conf
## See : https://github.com/dani-garcia/vaultwarden/wiki/Fail2Ban-Setup#synology-dsm
## Version 2022/08/06
# Fail2Ban jail configuration for vaultwarden
# Requires modification to Vaultwarden's settings
# https://github.com/dani-garcia/vaultwarden/wiki/Logging#logging-to-a-file
[vaultwarden-auth]
enabled = true
port = 882,443,3012
# Doit correspondre au nom du fichier .conf dans le dossier filter.d
filter = vaultwarden-auth
banaction = %(banaction_allports)s
logpath = /var/log/vaultwarden.log
maxretry = 3
bantime = 14400
findtime = 14400Merci pour le coup de main
