msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m51s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-21 20:20:32 +01:00
parent 8d8307c9a6
commit 9221726408
7 changed files with 64 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
func/cdi_4400_hardening/4420_hardening_fail2ban.sh
View File

@@ -144,7 +144,7 @@ bantime.maxtime = 16d
bantime.multipliers = 1 2 4 8 16 32 64 128 256 384
bantime.overalljails = true
bantime.rndtime = 877s
filter = ciss.icmp
filter = ciss-icmp
findtime = 16m
logpath = /var/log/ufw.log
maxretry = 1
@@ -159,7 +159,7 @@ bantime.maxtime = 16d
bantime.multipliers = 1 2 4 8 16 32 64 128 256 384
bantime.overalljails = true
bantime.rndtime = 877s
filter = ciss.ufw
filter = ciss-ufw
findtime = 16m
logpath = /var/log/ufw.log
maxretry = 1
@@ -242,7 +242,7 @@ bantime.maxtime = 16d
bantime.multipliers = 1 2 4 8 16 32 64 128 256 384
bantime.overalljails = true
bantime.rndtime = 877s
filter = ciss.icmp
filter = ciss-icmp
findtime = 16m
logpath = /var/log/ufw.log
maxretry = 3
@@ -257,7 +257,7 @@ bantime.maxtime = 16d
bantime.multipliers = 1 2 4 8 16 32 64 128 256 384
bantime.overalljails = true
bantime.rndtime = 877s
filter = ciss.ufw
filter = ciss-ufw
findtime = 16m
logpath = /var/log/ufw.log
maxretry = 3
@@ -274,9 +274,9 @@ EOF
fi
insert_header "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
insert_comments "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
cat << EOF >> "${var_target}/etc/fail2ban/filter.d/ciss.icmp.conf"
insert_header "${var_target}/etc/fail2ban/filter.d/ciss-icmp.conf"
insert_comments "${var_target}/etc/fail2ban/filter.d/ciss-icmp.conf"
cat << EOF >> "${var_target}/etc/fail2ban/filter.d/ciss-icmp.conf"
[Definition]
# Generic ICMP/ICMPv6 blocks
failregex = ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?\bPROTO=ICMP\b.*$
@@ -285,9 +285,9 @@ failregex = ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?\bPROTO=ICMP\
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=conf
EOF
insert_header "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
insert_comments "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
cat << EOF >> "${var_target}/etc/fail2ban/filter.d/ciss.ufw.conf"
insert_header "${var_target}/etc/fail2ban/filter.d/ciss-ufw.conf"
insert_comments "${var_target}/etc/fail2ban/filter.d/ciss-ufw.conf"
cat << EOF >> "${var_target}/etc/fail2ban/filter.d/ciss-ufw.conf"
[Definition]
# Match UFW BLOCK/REJECT with a source IP and *any* port field (SPT or DPT), protocol may be missing.
failregex = ^.*UFW (?:BLOCK|REJECT).*?\bSRC=<HOST>\b.*?(?:\bDPT=\d+\b|\bSPT=\d+\b).*$