PapaTramp/reverse-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): fail2ban sshd.local с ignoreip admin и banaction ufw.

Browse Source
This commit is contained in:
PTah
2026-06-15 15:06:53 +10:00
parent fc12d35f23
commit a7de0d0555
3 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security/haproxy-host.md
+2
View File
@@ -104,6 +104,8 @@ sudo fail2ban-client status haproxy-reject
Порог: **15** reject за **10 мин** → бан **24 ч** через UFW. `ignoreip`: LAN, VPN, admin. Порог: **15** reject за **10 мин** → бан **24 ч** через UFW. `ignoreip`: LAN, VPN, admin.
**sshd:** `jail.d/sshd.local` — `banaction = ufw`, те же `ignoreip` (не банить admin/VPN/LAN).
После `systemctl restart fail2ban` подождите 1–2 с перед `fail2ban-client status` (сокет). После `systemctl restart fail2ban` подождите 1–2 с перед `fail2ban-client status` (сокет).
### SSH (пример) ### SSH (пример)
scripts/security/fail2ban-install.sh
+2
View File
@@ -29,6 +29,7 @@ command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt i
install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
install -m 0644 "$F2B_DIR/sshd.local" /etc/fail2ban/jail.d/sshd.local
log "fail2ban-regex haproxy-json-reject" log "fail2ban-regex haproxy-json-reject"
fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8 fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
@@ -44,4 +45,5 @@ systemctl restart fail2ban
sleep 1 sleep 1
fail2ban-client status fail2ban-client status
fail2ban-client status haproxy-reject fail2ban-client status haproxy-reject
fail2ban-client status sshd
log "done" log "done"
scripts/security/fail2ban/sshd.local
+4
View File
@@ -0,0 +1,4 @@
[sshd]
enabled = true
banaction = ufw
ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121