V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4400_hardening/4420_hardening_fail2ban.sh

@@ -17,12 +17,14 @@ guard_sourcing
 # Globals:
 #   ARY_ALLOW_IPV4
 #   ARY_ALLOW_IPV6
+#   RECOVERY
 #   TARGET
 #   VAR_FINAL_FQDN
 #   VAR_FINAL_IPV4
 #   VAR_FINAL_IPV6
 #   VAR_LINK_IPV6
 #   VAR_PROVIDER
+#   VAR_RUN_RECOVERY
 #   VAR_SSH_PORT
 # Arguments:
 #   None
@@ -32,29 +34,33 @@ guard_sourcing
 hardening_fail2ban() {
   ### Declare Arrays, HashMaps, and Variables.
   declare -r  var_logfile="/root/.ciss/cdi/log/4420_hardening_fail2ban.log"
+  declare     var_target="${TARGET}"
 
-  chroot_logger "${TARGET}${var_logfile}"
+  ### Check for TARGET / RECOVERY.
+  [[ "${VAR_RUN_RECOVERY}" == "true" ]] && var_target="${RECOVERY}"
 
-  mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc/fail2ban/jail.d"
-  cp "${TARGET}/etc/fail2ban/fail2ban.conf" "${TARGET}/root/.ciss/cdi/backup/etc/fail2ban/fail2ban.conf.bak"
-  mv "${TARGET}/etc/fail2ban/jail.d/defaults-debian.conf" "${TARGET}/root/.ciss/cdi/backup/etc/fail2ban/jail.d/defaults-debian.conf.bak"
+  chroot_logger "${var_target}${var_logfile}"
+
+  mkdir -p "${var_target}/root/.ciss/cdi/backup/etc/fail2ban/jail.d"
+  cp "${var_target}/etc/fail2ban/fail2ban.conf" "${var_target}/root/.ciss/cdi/backup/etc/fail2ban/fail2ban.conf.bak"
+  mv "${var_target}/etc/fail2ban/jail.d/defaults-debian.conf" "${var_target}/root/.ciss/cdi/backup/etc/fail2ban/jail.d/defaults-debian.conf.bak"
 
   # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024305
-  insert_header   "${TARGET}/etc/fail2ban/fail2ban.local"
-  insert_comments "${TARGET}/etc/fail2ban/fail2ban.local"
-  cat << 'EOF' >> "${TARGET}/etc/fail2ban/fail2ban.local"
+  insert_header   "${var_target}/etc/fail2ban/fail2ban.local"
+  insert_comments "${var_target}/etc/fail2ban/fail2ban.local"
+  cat << 'EOF' >> "${var_target}/etc/fail2ban/fail2ban.local"
 [DEFAULT]
 allowipv6 = auto
 
 EOF
 
-  insert_header   "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
-  insert_comments "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+  insert_header   "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
+  insert_comments "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 
   if [[ "${#ARY_ALLOW_IPV4[@]}" -gt 0 ]]; then
 
     ### fail2ban ufw aggressive mode, one attempt for jumphost configuration.
-    cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 [DEFAULT]
 usedns    = yes
 ignoreip  = 127.0.0.0/8 ::1
@@ -64,28 +70,37 @@ EOF
 
     if [[ "${VAR_LINK_IPV6}" == "true" ]]; then
 
-      cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+      cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
   ${VAR_FINAL_IPV6}/64
 EOF
     fi
 
-    cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 # Jumphost
   ${ARY_ALLOW_IPV4[*]}
 EOF
 
     if [[ "${VAR_LINK_IPV6}" == "true" ]]; then
 
-      cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+      cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
   ${ARY_ALLOW_IPV6[*]}
 EOF
     fi
 
-    cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 maxretry  = 8
 findtime  = 24h
 bantime   = 24h
 
+[recidive]
+enabled   = true
+filter    = recidive
+logpath   = /var/log/fail2ban/fail2ban.log*
+banaction = iptables-allports
+bantime   = 32d
+findtime  = 384d
+maxretry  = 4
+
 [sshd]
 enabled   = true
 backend   = systemd
@@ -112,7 +127,6 @@ logpath   = /var/log/ufw.log
 maxretry  = 1
 findtime  = 24h
 bantime   = 24h
-protocol  = tcp,udp
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
@@ -120,7 +134,7 @@ EOF
   else
 
     ### fail2ban ufw aggressive mode, 32 attempts for NO jumphost configuration.
-    cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 [DEFAULT]
 usedns    = yes
 ignoreip  = 127.0.0.0/8 ::1
@@ -130,16 +144,25 @@ EOF
 
     if [[ "${VAR_LINK_IPV6}" == "true" ]]; then
 
-      cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+      cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
   ${VAR_FINAL_IPV6}/64
 EOF
     fi
 
-    cat << EOF >> "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 maxretry  = 8
 findtime  = 24h
 bantime   = 24h
 
+[recidive]
+enabled   = true
+filter    = recidive
+logpath   = /var/log/fail2ban/fail2ban.log*
+banaction = iptables-allports
+bantime   = 32d
+findtime  = 384d
+maxretry  = 4
+
 [sshd]
 enabled   = true
 backend   = systemd
@@ -166,7 +189,6 @@ logpath   = /var/log/ufw.log
 maxretry  = 8
 findtime  = 24h
 bantime   = 24h
-protocol  = tcp,udp
 
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
@@ -176,16 +198,19 @@ EOF
   ### Provider Hetzner needs special ignoreip rules.
   if [[ "${VAR_PROVIDER}" == "hetzner" ]]; then
 
-    sed -i '0,/^maxretry/{s/^maxretry/# Hetzner Intern\n  172.31.1.1\/16\n&/}' "${TARGET}/etc/fail2ban/jail.d/ciss-default.conf"
+    sed -i '0,/^maxretry/{s/^maxretry/# Hetzner Intern\n  172.31.1.1\/16\n&/}' "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 
   fi
 
-  insert_header   "${TARGET}/etc/fail2ban/filter.d/ciss.ufw.conf"
-  insert_comments "${TARGET}/etc/fail2ban/filter.d/ciss.ufw.conf"
-  cat << EOF >>   "${TARGET}/etc/fail2ban/filter.d/ciss.ufw.conf"
+  insert_header   "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
+  insert_comments "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
+  cat << EOF >>   "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
+
 [Definition]
-failregex = ^.*UFW BLOCK.* SRC=<HOST> .*DPT=\d+ .*
+failregex = \[UFW BLOCK\].+SRC=<HOST> DST
 ignoreregex =
+
+# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
   # Hardening of fail2ban systemd: https://wiki.archlinux.org/title/fail2ban#Service_hardening
@@ -193,12 +218,12 @@ EOF
   # file. "CAP_NET_ADMIN" and "CAP_NET_RAW" allow fail2ban to operate on any firewall that has a command-line shell interface.
   # By using 'ProtectSystem=strict' the filesystem hierarchy will only be read-only; 'ReadWritePaths' allows Fail2ban to have
   # write access on required paths.
-  mkdir -p "${TARGET}/etc/systemd/system/fail2ban.service.d"
-  mkdir -p "${TARGET}/var/log/fail2ban"
+  mkdir -p "${var_target}/etc/systemd/system/fail2ban.service.d"
+  mkdir -p "${var_target}/var/log/fail2ban"
 
-  insert_header   "${TARGET}/etc/systemd/system/fail2ban.service.d/override.conf"
-  insert_comments "${TARGET}/etc/systemd/system/fail2ban.service.d/override.conf"
-  cat << EOF >>   "${TARGET}/etc/systemd/system/fail2ban.service.d/override.conf"
+  insert_header   "${var_target}/etc/systemd/system/fail2ban.service.d/override.conf"
+  insert_comments "${var_target}/etc/systemd/system/fail2ban.service.d/override.conf"
+  cat << EOF >>   "${var_target}/etc/systemd/system/fail2ban.service.d/override.conf"
 [Service]
 PrivateDevices=yes
 PrivateTmp=yes
@@ -214,29 +239,53 @@ ProtectClock=true
 ProtectHostname=true
 EOF
 
-  cat << 'EOF' >> "${TARGET}/etc/fail2ban/fail2ban.local"
+  cat << 'EOF' >> "${var_target}/etc/fail2ban/fail2ban.local"
 [Definition]
 logtarget = /var/log/fail2ban/fail2ban.log
 
+[Database]
+# Keep entries for at least 384 days to cover recidive findtime.
+dbpurgeage = 384d
+
 # vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
 EOF
 
   ### Logrotate must be updated too.
-  mkdir -p "${TARGET}/root/.ciss/cdi/backup/etc/logrotate.d"
-  cp "${TARGET}/etc/logrotate.d/fail2ban" "${TARGET}/root/.ciss/cdi/backup/etc/logrotate.d/fail2ban.bak"
-  sed -i 's/\/var\/log\/fail2ban.log/\/var\/log\/fail2ban\/fail2ban.log/1' "${TARGET}/etc/logrotate.d/fail2ban"
-  touch "${TARGET}/var/log/fail2ban/fail2ban.log"
-  chmod 640 "${TARGET}/var/log/fail2ban/fail2ban.log"
+  mkdir -p "${var_target}/root/.ciss/cdi/backup/etc/logrotate.d"
+  cp "${var_target}/etc/logrotate.d/fail2ban" "${var_target}/root/.ciss/cdi/backup/etc/logrotate.d/fail2ban.bak"
+  cat << EOF >| "${var_target}/etc/logrotate.d/fail2ban"
+/var/log/fail2ban/fail2ban.log {
 
-  if [[ ! -f "${TARGET}/var/log/ufw.log" ]]; then
-    install -d -m 0755 "${TARGET}/var/log"
-    : >| "${TARGET}/var/log/ufw.log"
-    chmod 0640 "${TARGET}/var/log/ufw.log"
+    daily
+    rotate 384
+    compress
+    # Do not rotate if empty
+    notifempty
+
+    delaycompress
+    missingok
+    postrotate
+        fail2ban-client flushlogs 1>/dev/null
+    endscript
+
+    # If fail2ban runs as non-root it still needs to have write access
+    # to logfiles.
+    # create 640 fail2ban adm
+    create 640 root adm
+}
+EOF
+  touch "${var_target}/var/log/fail2ban/fail2ban.log"
+  chmod 0640 "${var_target}/var/log/fail2ban/fail2ban.log"
+
+  if [[ ! -f "${var_target}/var/log/ufw.log" ]]; then
+    install -d -m 0755 "${var_target}/var/log"
+    : >| "${var_target}/var/log/ufw.log"
+    chmod 0640 "${var_target}/var/log/ufw.log"
   fi
 
   ### Merge / Dump-Parse via 'fail2ban-client -d'. All '*.conf', '*.local', and 'jail.*'-files are read, inherited, and merged.
   ### Syntax, path, and key errors result in a non-zero exit.
-  chroot_script "${TARGET}" "
+  chroot_script "${var_target}" "
     fail2ban-client -d >> ${var_logfile} && echo "OK: config parsed" >> ${var_logfile} || echo "ERROR: config invalid" >> ${var_logfile}
   "