Skip to content

Commit 357eb42

Browse files
serghey-rodinserghey-rodin
committed
Firewall with Fail2ban support
1 parent f692667 commit 357eb42

27 files changed

+936
-50
lines changed

‎bin/v-add-firewall-ban‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
#!/bin/bash
2+
# info: add firewall blocking rule
3+
# options: IP CHAIN
4+
#
5+
# The function adds new blocking rule to system firewall
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Importing system variables
13+
source /etc/profile
14+
15+
# Argument defenition
16+
ip=$1
17+
chain=$(echo $2|tr '[:lower:]' '[:upper:]')
18+
19+
# Defining absolute path for iptables and modprobe
20+
iptables="/sbin/iptables"
21+
22+
# Includes
23+
source $VESTA/func/main.sh
24+
source $VESTA/conf/vesta.conf
25+
26+
27+
#----------------------------------------------------------#
28+
# Verifications #
29+
#----------------------------------------------------------#
30+
31+
check_args '2' "$#" 'IP CHAIN'
32+
validate_format 'ip' 'chain'
33+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
34+
35+
36+
#----------------------------------------------------------#
37+
# Action #
38+
#----------------------------------------------------------#
39+
40+
# Checking server ip
41+
if [ -e "$VESTA/data/ips/$ip" ] || [ "$ip" = '127.0.0.1' ]; then
42+
exit
43+
fi
44+
45+
# Checking ip exclusions
46+
excludes="$VESTA/data/firewall/excludes.conf"
47+
check_excludes=$(grep "^$ip$" $excludes 2>/dev/null)
48+
if [ ! -z "$check_excludes" ]; then
49+
exit
50+
fi
51+
52+
# Checking ip in banlist
53+
conf="$VESTA/data/firewall/banlist.conf"
54+
check_ip=$(grep "IP='$ip' CHAIN='$chain'" $conf 2>/dev/null)
55+
if [ ! -z "$check_ip" ]; then
56+
exit
57+
fi
58+
59+
# Adding chain
60+
$BIN/v-add-firewall-chain $chain
61+
62+
# Adding ip to banlist
63+
echo "IP='$ip' CHAIN='$chain' TIME='$TIME' DATE='$DATE'" >> $conf
64+
$iptables -I fail2ban-$chain 1 -s $ip \
65+
-j REJECT --reject-with icmp-port-unreachable 2>/dev/null
66+
67+
# Changing permissions
68+
chmod 660 $conf
69+
70+
71+
#----------------------------------------------------------#
72+
# Vesta #
73+
#----------------------------------------------------------#
74+
75+
# Logging
76+
log_event "$OK" "$EVENT"
77+
78+
exit

‎bin/v-add-firewall-chain‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
#!/bin/bash
2+
# info: add firewall chain
3+
# options: CHAIN [PORT] [PROTOCOL] [PROTOCOL]
4+
#
5+
# The function adds new rule to system firewall
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Importing system variables
13+
source /etc/profile
14+
15+
# Argument defenition
16+
chain=$(echo $1 | tr '[:lower:]' '[:upper:]')
17+
port=$2
18+
protocol=${4-TCP}
19+
protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]')
20+
21+
# Defining absolute path to iptables
22+
iptables="/sbin/iptables"
23+
24+
# Includes
25+
source $VESTA/func/main.sh
26+
source $VESTA/conf/vesta.conf
27+
28+
29+
#----------------------------------------------------------#
30+
# Verifications #
31+
#----------------------------------------------------------#
32+
33+
check_args '1' "$#" 'CHAIN [PORT] [PROTOCOL]'
34+
validate_format 'chain'
35+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
36+
37+
38+
#----------------------------------------------------------#
39+
# Action #
40+
#----------------------------------------------------------#
41+
42+
# Checking known chains
43+
case $chain in
44+
SSH) port=22; protocol=TCP ;;
45+
FTP) port=21; protocol=TCP ;;
46+
MAIL) port=25; protocol=TCP ;;
47+
DNS) port=53; protocol=UDP ;;
48+
HTTP) port=80; protocol=TCP ;;
49+
HTTPS) port=443; protocol=TCP ;;
50+
POP3) port=110; protocol=TCP ;;
51+
IMAP) port=143; protocol=TCP ;;
52+
MYSQL) port=3306; protocol=TCP ;;
53+
POSTGRES) port=5432; protocol=TCP ;;
54+
VESTA) port=8083; protocol=TCP ;;
55+
*) check_args '2' "$#" 'CHAIN PORT' ;;
56+
esac
57+
58+
# Adding chain
59+
$iptables -N fail2ban-$chain 2>/dev/null
60+
if [ $? -eq 0 ]; then
61+
$iptables -A fail2ban-$chain -j RETURN
62+
$iptables -I INPUT -p $protocol --dport $port -j fail2ban-$chain
63+
fi
64+
65+
# Preserving chain
66+
chains=$VESTA/data/firewall/chains.conf
67+
check_chain=$(grep "CHAIN='$chain'" $chains 2>/dev/null)
68+
if [ -z "$check_chain" ]; then
69+
echo "CHAIN='$chain' PORT='$port' PROTOCOL='$protocol'" >> $chains
70+
fi
71+
72+
# Changing permissions
73+
chmod 660 $chains
74+
75+
76+
#----------------------------------------------------------#
77+
# Vesta #
78+
#----------------------------------------------------------#
79+
80+
# Logging
81+
log_event "$OK" "$EVENT"
82+
83+
exit

bin/v-add-sys-firewall-rule renamed to bin/v-add-firewall-rule

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: add firewall rule
3-
# options: ACTION PROTOCOL PORT IP [COMMENT] [RULE]
3+
# options: ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]
44
#
55
# The function adds new rule to system firewall
66

@@ -9,11 +9,15 @@
99
# Variable&Function #
1010
#----------------------------------------------------------#
1111

12+
# Importing system variables
13+
source /etc/profile
14+
1215
# Argument defenition
1316
action=$(echo $1|tr '[:lower:]' '[:upper:]')
14-
protocol=$(echo $2|tr '[:lower:]' '[:upper:]')
17+
ip=$2
1518
port_ext=$3
16-
ip=$4
19+
protocol=${4-TCP}
20+
protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]')
1721
comment=$5
1822
rule=$6
1923

@@ -24,30 +28,30 @@ source $VESTA/conf/vesta.conf
2428
# Get next firewall rule id
2529
get_next_fw_rule() {
2630
if [ -z "$rule" ]; then
27-
curr_str=$(grep "RULE=" $VESTA/data/firewall/rules_ipv4.conf |\
31+
curr_str=$(grep "RULE=" $VESTA/data/firewall/rules.conf |\
2832
cut -f 2 -d \' | sort -n | tail -n1)
2933
rule="$((curr_str +1))"
3034
fi
3135
}
3236

3337
sort_fw_rules() {
34-
cat $VESTA/data/firewall/rules_ipv4.conf |\
35-
sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp
36-
mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \
37-
$VESTA/data/firewall/rules_ipv4.conf
38+
cat $VESTA/data/firewall/rules.conf |\
39+
sort -n -k 2 -t \' > $VESTA/data/firewall/rules.conf.tmp
40+
mv -f $VESTA/data/firewall/rules.conf.tmp \
41+
$VESTA/data/firewall/rules.conf
3842
}
3943

4044

4145
#----------------------------------------------------------#
4246
# Verifications #
4347
#----------------------------------------------------------#
4448

45-
check_args '4' "$#" 'ACTION PROTOCOL PORT IP [COMMENT] [RULE]'
49+
check_args '3' "$#" 'ACTION IP PORT [PROTOCOL] [COMMENT] [RULE]'
4650
validate_format 'action' 'protocol' 'port_ext' 'ip'
4751
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
4852
get_next_fw_rule
4953
validate_format 'rule'
50-
is_object_new '../../data/firewall/rules_ipv4' 'RULE' "$rule"
54+
is_object_new '../../data/firewall/rules' 'RULE' "$rule"
5155
if [ ! -z "$comment"]; then
5256
validate_format 'comment'
5357
fi
@@ -57,22 +61,22 @@ fi
5761
# Action #
5862
#----------------------------------------------------------#
5963

60-
# Concatenating cron string
64+
# Concatenating rule
6165
str="RULE='$rule' ACTION='$action' PROTOCOL='$protocol' PORT='$port_ext'"
6266
str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
6367
str="$str TIME='$TIME' DATE='$DATE'"
6468

65-
# Adding to crontab
66-
echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf
69+
# Adding to config
70+
echo "$str" >> $VESTA/data/firewall/rules.conf
6771

6872
# Changing permissions
69-
chmod 660 $VESTA/data/firewall/rules_ipv4.conf
73+
chmod 660 $VESTA/data/firewall/rules.conf
7074

7175
# Sorting firewall rules by id number
7276
sort_fw_rules
7377

7478
# Updating system firewall
75-
$BIN/v-update-sys-firewall
79+
$BIN/v-update-firewall
7680

7781

7882
#----------------------------------------------------------#

bin/v-change-sys-firewall-rule renamed to bin/v-change-firewall-rule

Lines changed: 20 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# info: change firewall rule
3-
# options: RULE ACTION PROTOCOL PORT IP [COMMENT]
3+
# options: RULE ACTION IP PORT [PROTOCOL] [COMMENT]
44
#
55
# The function is used for changing existing firewall rule.
66
# It fully replace rule with new one but keeps same id.
@@ -10,12 +10,16 @@
1010
# Variable&Function #
1111
#----------------------------------------------------------#
1212

13+
# Importing system variables
14+
source /etc/profile
15+
1316
# Argument defenition
1417
rule=$1
1518
action=$(echo $2|tr '[:lower:]' '[:upper:]')
16-
protocol=$(echo $3|tr '[:lower:]' '[:upper:]')
19+
ip=$3
1720
port_ext=$4
18-
ip=$5
21+
protocol=${5-TCP}
22+
protocol=$(echo $protocol|tr '[:lower:]' '[:upper:]')
1923
comment=$6
2024

2125
# Includes
@@ -24,21 +28,24 @@ source $VESTA/conf/vesta.conf
2428

2529
# Sort function
2630
sort_fw_rules() {
27-
cat $VESTA/data/firewall/rules_ipv4.conf |\
28-
sort -n -k 2 -t \' > $VESTA/data/firewall/rules_ipv4.conf.tmp
29-
mv -f $VESTA/data/firewall/rules_ipv4.conf.tmp \
30-
$VESTA/data/firewall/rules_ipv4.conf
31+
cat $VESTA/data/firewall/rules.conf |\
32+
sort -n -k 2 -t \' > $VESTA/data/firewall/rules.conf.tmp
33+
mv -f $VESTA/data/firewall/rules.conf.tmp \
34+
$VESTA/data/firewall/rules.conf
3135
}
3236

3337

3438
#----------------------------------------------------------#
3539
# Verifications #
3640
#----------------------------------------------------------#
3741

38-
check_args '5' "$#" 'RULE ACTION PROTOCOL PORT IP [COMMENT]'
39-
validate_format 'rule' 'action' 'protocol' 'port_ext' 'ip' 'comment'
42+
check_args '5' "$#" 'RULE ACTION IP PORT [PROTOCOL] [COMMENT]'
43+
validate_format 'rule' 'action' 'protocol' 'port_ext' 'ip'
44+
if [ ! -z "$comment" ]; then
45+
validate_format 'comment'
46+
fi
4047
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
41-
is_object_valid '../../data/firewall/rules_ipv4' 'RULE' "$rule"
48+
is_object_valid '../../data/firewall/rules' 'RULE' "$rule"
4249

4350

4451
#----------------------------------------------------------#
@@ -51,16 +58,16 @@ str="$str IP='$ip' COMMENT='$comment' SUSPENDED='no'"
5158
str="$str TIME='$TIME' DATE='$DATE'"
5259

5360
# Deleting old rule
54-
sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules_ipv4.conf
61+
sed -i "/RULE='$rule' /d" $VESTA/data/firewall/rules.conf
5562

5663
# Adding new
57-
echo "$str" >> $VESTA/data/firewall/rules_ipv4.conf
64+
echo "$str" >> $VESTA/data/firewall/rules.conf
5865

5966
# Sorting firewall rules by id number
6067
sort_fw_rules
6168

6269
# Updating system firewall
63-
$BIN/v-update-sys-firewall
70+
$BIN/v-update-firewall
6471

6572

6673
#----------------------------------------------------------#

‎bin/v-delete-firewall-ban‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
# info: delete firewall blocking rule
3+
# options: IP CHAIN
4+
#
5+
# The function deletes blocking rule from system firewall
6+
7+
8+
#----------------------------------------------------------#
9+
# Variable&Function #
10+
#----------------------------------------------------------#
11+
12+
# Importing system variables
13+
source /etc/profile
14+
15+
# Argument defenition
16+
ip=$1
17+
chain=$(echo $2|tr '[:lower:]' '[:upper:]')
18+
19+
# Defining absolute path for iptables and modprobe
20+
iptables="/sbin/iptables"
21+
22+
# Includes
23+
source $VESTA/func/main.sh
24+
source $VESTA/conf/vesta.conf
25+
26+
27+
#----------------------------------------------------------#
28+
# Verifications #
29+
#----------------------------------------------------------#
30+
31+
check_args '2' "$#" 'IP CHAIN'
32+
validate_format 'ip' 'chain'
33+
is_system_enabled "$FIREWALL_SYSTEM" 'FIREWALL_SYSTEM'
34+
35+
36+
#----------------------------------------------------------#
37+
# Action #
38+
#----------------------------------------------------------#
39+
40+
# Checking ip in banlist
41+
conf="$VESTA/data/firewall/banlist.conf"
42+
check_ip=$(grep "IP='$ip' CHAIN='$chain'" $conf 2>/dev/null)
43+
if [ -z "$check_ip" ]; then
44+
exit
45+
fi
46+
47+
# Deleting ip from banlist
48+
sed -i "/IP='$ip' CHAIN='$chain'/d" $conf
49+
$iptables -D fail2ban-$chain -s $ip \
50+
-j REJECT --reject-with icmp-port-unreachable 2>/dev/null
51+
52+
# Changing permissions
53+
chmod 660 $conf
54+
55+
56+
#----------------------------------------------------------#
57+
# Vesta #
58+
#----------------------------------------------------------#
59+
60+
# Logging
61+
log_event "$OK" "$EVENT"
62+
63+
exit

0 commit comments

Comments
 (0)