feat(security): fail2ban для HAProxy JSON reject и Zabbix 403.

2026-06-15 15:03:30 +10:00
parent 2ce71df1f8
commit cd14f0a1c4
8 changed files with 115 additions and 0 deletions
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# Установка fail2ban filter/jail для HAProxy JSON-лога.
+#   sudo bash fail2ban-install.sh
+#   sudo bash fail2ban-install.sh --test   # только fail2ban-regex
+set -Eeuo pipefail
+
+SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+F2B_DIR="$SCRIPT_DIR/fail2ban"
+TEST_ONLY=0
+
+die() { echo "error: $*" >&2; exit 1; }
+log() { echo "[*] $*"; }
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --test) TEST_ONLY=1; shift ;;
+        -h | --help)
+            echo "Usage: fail2ban-install.sh [--test]"
+            exit 0
+            ;;
+        *) die "unknown option: $1" ;;
+    esac
+done
+
+[[ -d $F2B_DIR ]] || die "missing $F2B_DIR"
+
+command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt install fail2ban)"
+
+install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
+install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
+install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
+
+log "fail2ban-regex haproxy-json-reject"
+fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
+
+if [[ $TEST_ONLY -eq 1 ]]; then
+    log "test only — jail not restarted"
+    exit 0
+fi
+
+fail2ban-client -t
+systemctl enable fail2ban
+systemctl restart fail2ban
+sleep 1
+fail2ban-client status
+fail2ban-client status haproxy-reject
+log "done"