PTah
50 lines
1.5 KiB
Bash
Executable File
50 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Установка fail2ban filter/jail для HAProxy JSON-лога.
|
|
# sudo bash fail2ban-install.sh
|
|
# sudo bash fail2ban-install.sh --test # только fail2ban-regex
|
|
set -Eeuo pipefail
|
|
|
|
SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
F2B_DIR="$SCRIPT_DIR/fail2ban"
|
|
TEST_ONLY=0
|
|
|
|
die() { echo "error: $*" >&2; exit 1; }
|
|
log() { echo "[*] $*"; }
|
|
|
|
while [[ $# -gt 0 ]]; do
|
|
case "$1" in
|
|
--test) TEST_ONLY=1; shift ;;
|
|
-h | --help)
|
|
echo "Usage: fail2ban-install.sh [--test]"
|
|
exit 0
|
|
;;
|
|
*) die "unknown option: $1" ;;
|
|
esac
|
|
done
|
|
|
|
[[ -d $F2B_DIR ]] || die "missing $F2B_DIR"
|
|
|
|
command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt install fail2ban)"
|
|
|
|
install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
|
|
install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
|
|
install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
|
|
install -m 0644 "$F2B_DIR/sshd.local" /etc/fail2ban/jail.d/sshd.local
|
|
|
|
log "fail2ban-regex haproxy-json-reject"
|
|
fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
|
|
|
|
if [[ $TEST_ONLY -eq 1 ]]; then
|
|
log "test only — jail not restarted"
|
|
exit 0
|
|
fi
|
|
|
|
fail2ban-client -t
|
|
systemctl enable fail2ban
|
|
systemctl restart fail2ban
|
|
sleep 1
|
|
fail2ban-client status
|
|
fail2ban-client status haproxy-reject
|
|
fail2ban-client status sshd
|
|
log "done"
|