msw/CISS.debian.installer
SHA256
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V8.00.000.2025.06.17
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m52s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-10-24 10:57:49 +01:00
parent fd60deb5b9
commit dcd3680077
138 changed files with 398 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
func/cdi_4400_hardening/4420_hardening_fail2ban.sh
View File

@@ -10,7 +10,7 @@
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
guard_sourcing
guard_sourcing || return "${ERR_GUARD_SOURCE}"
#######################################
# Hardening 'fail2ban'.
@@ -62,6 +62,8 @@ EOF
### fail2ban ufw aggressive mode, one attempt for jumphost configuration.
cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports
dbpurgeage = 384d
# 127.0.0.1/8 - IPv4 loopback range (local host)
# ::1/128 - IPv6 loopback
@@ -97,7 +99,7 @@ usedns = yes
[recidive]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 8d
bantime.increment = true
bantime.factor = 1
@@ -136,7 +138,7 @@ maxretry = 4
[icmp]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 1h
bantime.increment = true
bantime.factor = 1
@@ -151,7 +153,7 @@ maxretry = 1
[ufw]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 1h
bantime.increment = true
bantime.factor = 1
@@ -172,6 +174,8 @@ EOF
### fail2ban ufw aggressive mode, 32 attempts for NO jumphost configuration.
cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports
dbpurgeage = 384d
# 127.0.0.1/8 - IPv4 loopback range (local host)
# ::1/128 - IPv6 loopback
@@ -195,7 +199,7 @@ usedns = yes
[recidive]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 8d
bantime.increment = true
bantime.factor = 1
@@ -234,7 +238,7 @@ maxretry = 4
[icmp]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 1h
bantime.increment = true
bantime.factor = 1
@@ -249,7 +253,7 @@ maxretry = 3
[ufw]
enabled = true
banaction = ufw[blocktype=deny]
banaction = %(banaction_allports)s
bantime = 1h
bantime.increment = true
bantime.factor = 1