feat(security): fail2ban для HAProxy JSON reject и Zabbix 403.

2026-06-15 15:03:30 +10:00
parent 2ce71df1f8
commit cd14f0a1c4
8 changed files with 115 additions and 0 deletions
@@ -0,0 +1,6 @@
+[Definition]
+
+# Сканеры и reject на fe_https_sni (неизвестный SNI, allowlist, мусор)
+failregex = ^.*haproxy\[(?:\d+|master)\]: \{"time":"[^"]*","client":"<HOST>".*"fe":"fe_https_sni","be":"fe_https_sni","srv":"<NOSRV>"
+
+ignoreregex =
@@ -0,0 +1,5 @@
+[Definition]
+
+failregex = ^.*haproxy\[(?:\d+|master)\]: <HOST>:\d+ \[[^\]]+\] fe_http_zabbix .* 403 
+
+ignoreregex =
@@ -0,0 +1,22 @@
+[DEFAULT]
+banaction = ufw
+banaction_allports = ufw
+allowipv6 = no
+
+[haproxy-reject]
+enabled  = true
+filter   = haproxy-json-reject
+logpath  = /var/log/haproxy.log
+maxretry = 15
+findtime = 600
+bantime  = 86400
+ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121
+
+[haproxy-zabbix-403]
+enabled  = true
+filter   = haproxy-zabbix-403
+logpath  = /var/log/haproxy.log
+maxretry = 10
+findtime = 600
+bantime  = 86400
+ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121