Set up fail2ban for nginx, move IPFS gateway to proxy role
This commit is contained in:
Râu Cao
parent
7f545404b1
commit
d06f5d7723
GPG Key ID:
15E65F399D084BA9
|
|
@ -26,6 +26,7 @@ cookbook 'users', '~> 5.3.1'
|
|||
cookbook 'hostname', '= 0.4.2'
|
||||
cookbook 'firewall', '~> 2.6.3'
|
||||
cookbook 'nginx', '= 9.0.0'
|
||||
cookbook 'fail2ban', '~> 7.0.4'
|
||||
# Remove when cookbooks stop depending on it, the build_essential resource is
|
||||
# part of Chef 14 (https://docs.chef.io/resource_build_essential.html)
|
||||
cookbook 'build-essential', '~> 8.2.1'
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ DEPENDENCIES
|
|||
compat_resource (= 12.19.0)
|
||||
composer (~> 2.7.0)
|
||||
elasticsearch (= 4.3.0)
|
||||
fail2ban (~> 7.0.4)
|
||||
firewall (~> 2.6.3)
|
||||
git (~> 10.0.0)
|
||||
golang (~> 5.3.1)
|
||||
|
|
@ -86,6 +87,8 @@ GRAPH
|
|||
ark (>= 0.0.0)
|
||||
chef-sugar (>= 0.0.0)
|
||||
yum (>= 0.0.0)
|
||||
fail2ban (7.0.4)
|
||||
yum-epel (>= 0.0.0)
|
||||
firewall (2.6.5)
|
||||
chef-sugar (>= 0.0.0)
|
||||
git (10.0.0)
|
||||
|
|
|
|||
|
|
@ -0,0 +1,218 @@
|
|||
# Changelog
|
||||
|
||||
All notable changes to this project will be documented in this file.
|
||||
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## 7.0.4 - *2022-08-07*
|
||||
|
||||
- Document missing service attributes
|
||||
|
||||
## 7.0.3 - *2022-08-07*
|
||||
|
||||
- CI: Switch to shared lint-unit workflow
|
||||
|
||||
## 7.0.2 - *2022-02-17*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
- Remove delivery folder
|
||||
|
||||
## 7.0.1 - *2021-08-30*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 7.0.0 - *2021-06-19*
|
||||
|
||||
- Chef 17 updates: enable `unified_mode` on all resources
|
||||
- Bump required Chef Infra Client to >= 15.3
|
||||
- Add `bantime` property to `fail2ban_jail` resource
|
||||
- Remove unsupported platforms
|
||||
- Remove logic for fail2ban < 0.9
|
||||
|
||||
## 6.3.3 - *2021-06-01*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 6.3.2 - *2021-02-26*
|
||||
|
||||
- Fix jail template to not set `port` or `logpath` if not defined in the resource
|
||||
|
||||
## 6.3.1 - *2020-12-09*
|
||||
|
||||
- improves resource documentation in README
|
||||
- fixes jail resource to support priority property in delete action
|
||||
|
||||
## 6.3.0 - *2020-12-01*
|
||||
|
||||
- Remove deprecated platform in spec tests
|
||||
- fixed wrong property in `fail2ban_jail` and `fail2ban_filter` resources
|
||||
- added documentation for above changes
|
||||
|
||||
## 6.2.1 (2020-05-05)
|
||||
|
||||
- Migrated build system to github actions for testing
|
||||
|
||||
## 6.2.0 (2020-01-26)
|
||||
|
||||
- Simplify platform check logic
|
||||
- Fix several parts of the recipe that were not compatible with Amazon Linux
|
||||
- Update all templates to use the same managed by chef warning
|
||||
|
||||
## 6.1.0 (2019-10-16)
|
||||
|
||||
- Adds Slack notifications as a notifier
|
||||
- Fixup testing
|
||||
|
||||
## 6.0.0 (2019-05-08)
|
||||
|
||||
- Require Chef 13 or later
|
||||
- Add support for Amazon Linux on Chef 13+
|
||||
- Add support for Ubuntu 18.04
|
||||
- Add new fail2ban_jail and fain2ban_filter resources that allow you to define individual filters and jails within your own recipes instead of using the monolithic attribute config. With the introduction of these resources the existing attribute driven workflow has been deprecated and will eventually be removed. Thank you OpenStreetMap for these great new resources.
|
||||
|
||||
## 5.0.2 (2018-07-18)
|
||||
|
||||
- Update specs to the latest platform versions
|
||||
- Testing updates
|
||||
- Delete jail.d/00-firewalld.conf on CentOS like we delete jail.d/defaults-debian.conf on Ubuntu)
|
||||
- Move templates out of the default directory
|
||||
|
||||
## 5.0.1 (2018-02-15)
|
||||
|
||||
- Update the minimum supported Chef release to 12.9 since we're using the Ohai package plugin now. We highly recommend you run at least the very latest Chef 12 reelase which includes additional packabe plugin fixes.
|
||||
|
||||
## 5.0.0 (2018-02-14)
|
||||
|
||||
- Add new logic to detect the fail2ban version and apply appropriate config for 0.8 vs > 0.8. This makes sure we're using the current on newer systems while still supporting Ubuntu 14.04
|
||||
- Remove defunct syslog config statements from very old fail2ban releases
|
||||
|
||||
## 4.0.1 (2017-04-26)
|
||||
|
||||
- Update apache2 license string
|
||||
|
||||
## 4.0.0 (2017-03-14)
|
||||
|
||||
**NOTE** The next version of this cookbook will be a rewrite to use custom resources and eliminate attributes. This should be backwards compatible to previous versions of the cookbook, but there are some changes that might break current assumptions so doing a major bump.
|
||||
|
||||
- [#33] Fix ubuntu platforms
|
||||
- Add ubuntu platform guards to default recipe
|
||||
- Update README to be more clear with regards to rsyslog
|
||||
- Remove defaults-debian.conf on ubuntu platforms, that assumes ssh enabled on nodes.
|
||||
- Modify metadata dependency to Chef 12.5+
|
||||
- Modify chef spec to remove service start, enable on resources as on debian platforms the service is started by install of package
|
||||
- Make test kitchen show deprecation errors
|
||||
- Remove EOL debian and ubuntu logic from default recipe
|
||||
|
||||
## 3.1.0 (2016-11-14)
|
||||
|
||||
- Add support for jail ignorecommand
|
||||
|
||||
## 3.0.0 (2016-09-16)
|
||||
|
||||
- Testing updates
|
||||
- Require Chef 12.1+
|
||||
- Add opensuse and opensuseleap to the metadata
|
||||
|
||||
## v2.3.1 (2016-07-20)
|
||||
|
||||
- Added fixture cookbook
|
||||
- Cleanup of kitchen configurations
|
||||
- [#38] Default config values to avoid warning from pbanderas
|
||||
- [#37] Add support for 'sendername' setting on config from Restless-ET
|
||||
- [#35] Add support for configuring service backend from ares
|
||||
- many updates to testing
|
||||
- [#25] Allow jail actions of either format from rchekaluk
|
||||
- Add OpenSUSE platform
|
||||
|
||||
## v2.3.0 (2015-08-22)
|
||||
|
||||
- Updated Berksfile to 3.0 format
|
||||
- Added "generated by chef" comment headers to all templates
|
||||
- Added missing bantime service attribute to the readme
|
||||
- Resolved all rubocop warnings
|
||||
- Added yum-epel to the readme as a dependency
|
||||
- Removed the dependency on the yum cookbook. This cookbook only requires yum-epel, which handles the yum dependency
|
||||
- Added a chefignore file to prevent unnecessary files from being uploaded to the chef-server
|
||||
- Changed fail2ban package to install only vs. upgrading. Administrators should be able to choose when packages are upgraded
|
||||
- Change file mode definitions to be strings to preserve the leading zeros
|
||||
- Added testing / cookbook version badges to the readme
|
||||
- Added source_url and issues_url metadata for Chef 12
|
||||
- Add basic cookbook convergence chefspec tests
|
||||
- Updated the testing and contributing docs to more recent versions
|
||||
- Bumped all development and testing gems to the latest versions
|
||||
- Expanded Travis testing to ruby 2/2.1/2.2
|
||||
- Changed Opscode to Chef Software in all locations
|
||||
|
||||
## v2.2.1 (2014-10-15)
|
||||
|
||||
- [#24] Add default value for pidfile
|
||||
|
||||
## v2.2.0
|
||||
|
||||
- # 15 - Fix small typo in README.md for smtp
|
||||
|
||||
- # 16 - Support custom fail2ban filters
|
||||
|
||||
- # 21 - Service and defaults improvements, Fedora support
|
||||
|
||||
## v2.1.2
|
||||
|
||||
### Improvement
|
||||
|
||||
- **[COOK-3899](https://tickets.chef.io/browse/COOK-3899)** - Allow action override in service block
|
||||
|
||||
## v2.1.0
|
||||
|
||||
Updating for cookbook yum ~> 3.0 Fixing style or rubocop Updating test bits
|
||||
|
||||
## v2.0.4
|
||||
|
||||
fixing metadata version error. locking to 3.0
|
||||
|
||||
## v2.0.2
|
||||
|
||||
Locking yum dependency to '< 3'
|
||||
|
||||
## v2.0.0
|
||||
|
||||
[COOK-2530] Allow customisation of jail.local
|
||||
|
||||
## v1.2.4
|
||||
|
||||
### New Feature
|
||||
|
||||
- **[COOK-3383](https://tickets.chef.io/browse/COOK-3383)** - Add clarifying caveat about rsyslog in README
|
||||
|
||||
### Bug
|
||||
|
||||
- **[COOK-3249](https://tickets.chef.io/browse/COOK-3249)** - Fix default `jail.conf` on CentOS
|
||||
|
||||
### Improvement
|
||||
|
||||
- **[COOK-2748](https://tickets.chef.io/browse/COOK-2748)** - Handle `/etc.init.d/fail2ban status` for older versions
|
||||
|
||||
## v1.2.2
|
||||
|
||||
### Bug
|
||||
|
||||
- [COOK-2588]: Fail2ban needs to store the socket in the correct location
|
||||
- [COOK-2592]: fail2ban: Update jail file template to match current config file
|
||||
|
||||
## v1.2.0
|
||||
|
||||
- [COOK-2292] - Add fail2ban support for RHEL using EPEL
|
||||
- [COOK-2426] - Fail2ban cookbook needs syslog tunables in config file
|
||||
- Development repository only: test kitchen 1.0.alpha support
|
||||
|
||||
## v1.1.0
|
||||
|
||||
- [COOK-2291] - Add additional tunables to the fail2ban cookbook
|
||||
|
||||
## v1.0.2
|
||||
|
||||
- [COOK-2217] - Users should be able to configure the email address fail2ban uses to send messages
|
||||
|
||||
## v1.0.0
|
||||
|
||||
- Current public release.
|
||||
|
|
@ -0,0 +1,202 @@
|
|||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
|
|
@ -0,0 +1,221 @@
|
|||
# fail2ban Cookbook
|
||||
|
||||
[](https://supermarket.chef.io/cookbooks/fail2ban)
|
||||
[](https://github.com/sous-chefs/fail2ban/actions?query=workflow%3Aci)
|
||||
[](#backers)
|
||||
[](#sponsors)
|
||||
[](https://opensource.org/licenses/Apache-2.0)
|
||||
|
||||
Installs and configures `fail2ban`, a utility that watches logs for failed login attempts and blocks repeat offenders with firewall rules. On Redhat systems this cookbook will enable the EPEL repository in order to retrieve the fail2ban package.
|
||||
|
||||
## Maintainers
|
||||
|
||||
This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).
|
||||
|
||||
## Requirements
|
||||
|
||||
### Platforms
|
||||
|
||||
- Debian/Ubuntu
|
||||
- RHEL/CentOS/Scientific/Amazon/Oracle
|
||||
- Fedora
|
||||
- OpenSUSE
|
||||
|
||||
### Chef
|
||||
|
||||
- Chef 15.3+
|
||||
|
||||
### Cookbooks
|
||||
|
||||
- yum-epel
|
||||
|
||||
## Recipes
|
||||
|
||||
### default
|
||||
|
||||
Installs the fail2ban package, manages 2 templates: `/etc/fail2ban/fail2ban.conf` and `/etc/fail2ban/jail.conf`, and manages the fail2ban service.
|
||||
|
||||
## Attributes
|
||||
|
||||
This cookbook has a set of configuration options for fail2ban
|
||||
|
||||
- `default['fail2ban']['loglevel'] = 'INFO'`
|
||||
- `default['fail2ban']['logtarget'] = '/var/log/fail2ban.log'`
|
||||
- `default['fail2ban']['syslogsocket'] = 'auto'`
|
||||
- `default['fail2ban']['socket'] = '/var/run/fail2ban/fail2ban.sock'`
|
||||
- `default['fail2ban']['pidfile'] = '/var/run/fail2ban/fail2ban.pid'`
|
||||
- `default['fail2ban']['dbfile'] = '/var/lib/fail2ban/fail2ban.sqlite3'`
|
||||
- `default['fail2ban']['dbpurgeage'] = 86_400`
|
||||
|
||||
This cookbook has a set of configuration options for jail.conf
|
||||
|
||||
- `default['fail2ban']['ignoreip'] = '127.0.0.1/8'`
|
||||
- `default['fail2ban']['findtime'] = 600`
|
||||
- `default['fail2ban']['bantime'] = 300`
|
||||
- `default['fail2ban']['maxretry'] = 5`
|
||||
- `default['fail2ban']['backend'] = 'polling'`
|
||||
- `default['fail2ban']['email'] = 'root@localhost'`
|
||||
- `default['fail2ban']['sendername'] = 'Fail2Ban'`
|
||||
- `default['fail2ban']['action'] = 'action_'`
|
||||
- `default['fail2ban']['banaction'] = 'iptables-multiport'`
|
||||
- `default['fail2ban']['mta'] = 'sendmail'`
|
||||
- `default['fail2ban']['protocol'] = 'tcp'`
|
||||
- `default['fail2ban']['chain'] = 'INPUT'`
|
||||
|
||||
This cookbook makes use of a hash to compile the jail.local-file and filter config files:
|
||||
|
||||
```
|
||||
default['fail2ban']['services'] = {
|
||||
'ssh' => {
|
||||
"enabled" => "true",
|
||||
"port" => "ssh",
|
||||
"filter" => "sshd",
|
||||
"logpath" => node['fail2ban']['auth_log'],
|
||||
"maxretry" => "6"
|
||||
},
|
||||
'smtp' => {
|
||||
"enabled" => "true",
|
||||
"port" => "smtp",
|
||||
"filter" => "smtp",
|
||||
"logpath" => node['fail2ban']['auth_log'],
|
||||
"maxretry" => "6"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
The following attributes can be used per service:
|
||||
|
||||
- backend
|
||||
- banaction
|
||||
- bantime
|
||||
- enabled
|
||||
- filter
|
||||
- findtime
|
||||
- ignorecommand
|
||||
- logpath
|
||||
- maxretry
|
||||
- port
|
||||
- protocol
|
||||
|
||||
Creating custom fail2ban filters:
|
||||
|
||||
```
|
||||
default['fail2ban']['filters'] = {
|
||||
'nginx-proxy' => {
|
||||
"failregex" => ["^<HOST> -.*GET http.*"],
|
||||
"ignoreregex" => []
|
||||
},
|
||||
}
|
||||
```
|
||||
|
||||
In the case you would like to get Slack notifications on IP addresses banned/unbanned, this cookbook supports it by setting the following attributes:
|
||||
|
||||
```ruby
|
||||
# A Slack webhook looks like this:
|
||||
# https://hooks.slack.com/services/A123BCD4E/FG5HI6KLM/7n8opqrsT9UVWxyZ0AbCdefG
|
||||
default['fail2ban']['slack_webhook'] = nil
|
||||
# Then setting the Slack channel name without the hashtag (#)
|
||||
default['fail2ban']['slack_channel'] = 'general'
|
||||
```
|
||||
|
||||
Then you will get notifications like this:
|
||||
|
||||
> [hostname] Banned 🇳🇬 217.117.13.12 in the jail sshd after 5 attempts
|
||||
|
||||
## Resources
|
||||
|
||||
### fail2ban_filter
|
||||
|
||||
Manages fail2ban filters in `/etc/fail2ban/filters.d/`.
|
||||
|
||||
#### Actions
|
||||
|
||||
- `create` - Default. Creates a fail2ban filter.
|
||||
- `delete` - Deletes a fail2ban filter.
|
||||
|
||||
#### Properties
|
||||
|
||||
- `filter` - Specifies the name of the filter. This is the name property.
|
||||
- `source` - Specifies the template source. By default, this is set to `filter.erb`.
|
||||
- `cookbook` - Specifies the template cookbook. By default, this is set to `fail2ban`.
|
||||
- `failregex` - Specifies one or multiple regular expressions matching the failure.
|
||||
- `ignoreregex` - Specifies one or multiple regular expressions to ignore.
|
||||
|
||||
#### Examples
|
||||
|
||||
Configure a file for webmin authentication with multiple regular expressions matching the failure.
|
||||
|
||||
```ruby
|
||||
fail2ban_filter 'webmin-auth' do
|
||||
failregex ["^%(__prefix_line)sNon-existent login as .+ from <HOST>\s*$",
|
||||
"^%(__prefix_line)sInvalid login as .+ from <HOST>\s*$"]
|
||||
end
|
||||
```
|
||||
|
||||
### fail2ban_jail
|
||||
|
||||
Manages fail2ban jails in `/etc/fail2ban/jail.d/`.
|
||||
|
||||
#### Actions
|
||||
|
||||
- `create` - Default. Creates a fail2ban jail.
|
||||
- `delete` - Deletes a fail2ban jail.
|
||||
|
||||
#### Properties
|
||||
|
||||
- `jail` - Specifies the jail name. This is the name property.
|
||||
- `source` - Specifies the template source. By default, this is set to `jail.erb`.
|
||||
- `cookbook` - Specifies the template cookbook. By default, this is set to `fail2ban`.
|
||||
- `filter` - Specifies the name of the filter to be used by the jail to detect matches.
|
||||
- `logpath` - Specifies the path to the log file which is provided to the filter.
|
||||
- `protocol` - Specifies the protocol type, e.g. tcp, udp or all.
|
||||
- `ports` - Specifies an array of port(s) to watch.
|
||||
- `maxretry` - Specifies the number of matches which triggers ban action.
|
||||
- `ignoreips` - Specifies an array of IP addresses to ignore.
|
||||
|
||||
#### Examples
|
||||
|
||||
Create a new fail2ban jail for SSH that uses existing filter `sshd` and which bans client after 3 tries.
|
||||
|
||||
```ruby
|
||||
fail2ban_jail 'ssh' do
|
||||
ports %w(ssh)
|
||||
filter 'sshd'
|
||||
logpath node['fail2ban']['auth_log']
|
||||
maxretry 3
|
||||
end
|
||||
```
|
||||
|
||||
## Issues related to rsyslog
|
||||
|
||||
If you are using rsyslog parameter "$RepeatedMsgReduction on" in rsyslog.conf file
|
||||
then you can get "Last message repeated N times" in system log file (for example auth.log).
|
||||
Fail2ban will not work because the internal counter maxretry will not expand the repeated messages.
|
||||
Change parameter "$RepeatedMsgReduction off" in rsyslog.conf file for maximum accuracy of failed login attempts.
|
||||
|
||||
This rsyslog parameter is default ON for ubuntu 12.04 LTS for example.
|
||||
|
||||
## Contributors
|
||||
|
||||
This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false)
|
||||
|
||||
### Backers
|
||||
|
||||
Thank you to all our backers!
|
||||
|
||||
|
||||
|
||||
### Sponsors
|
||||
|
||||
Support this project by becoming a sponsor. Your logo will show up here with a link to your website.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
#
|
||||
# Cookbook:: fail2ban
|
||||
# Attributes:: default
|
||||
#
|
||||
# Copyright:: 2013-2018, Chef Software, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the 'License');
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an 'AS IS' BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
# fail2ban.conf configuration options
|
||||
default['fail2ban']['loglevel'] = 'INFO'
|
||||
default['fail2ban']['logtarget'] = '/var/log/fail2ban.log'
|
||||
default['fail2ban']['syslogsocket'] = 'auto'
|
||||
default['fail2ban']['socket'] = '/var/run/fail2ban/fail2ban.sock'
|
||||
default['fail2ban']['pidfile'] = '/var/run/fail2ban/fail2ban.pid'
|
||||
default['fail2ban']['dbfile'] = '/var/lib/fail2ban/fail2ban.sqlite3'
|
||||
default['fail2ban']['dbpurgeage'] = 86_400
|
||||
|
||||
# jail.conf configuration options
|
||||
default['fail2ban']['ignoreip'] = '127.0.0.1/8'
|
||||
default['fail2ban']['findtime'] = 600
|
||||
default['fail2ban']['bantime'] = 300
|
||||
default['fail2ban']['maxretry'] = 5
|
||||
default['fail2ban']['backend'] = 'polling'
|
||||
default['fail2ban']['email'] = 'root@localhost'
|
||||
default['fail2ban']['sendername'] = 'Fail2Ban'
|
||||
default['fail2ban']['action'] = 'action_'
|
||||
default['fail2ban']['banaction'] = 'iptables-multiport'
|
||||
default['fail2ban']['mta'] = 'sendmail'
|
||||
default['fail2ban']['protocol'] = 'tcp'
|
||||
default['fail2ban']['chain'] = 'INPUT'
|
||||
# Create and copy/past your Slack webhook in the following attribute and you'll
|
||||
# get Slack message on banning/unbanning IP like this:
|
||||
# [hostname] Banned 🇳🇬 217.117.13.12 in the jail sshd after 5 attempts
|
||||
#
|
||||
# A Slack webhook looks like this:
|
||||
# https://hooks.slack.com/services/A123BCD4E/FG5HI6KLM/7n8opqrsT9UVWxyZ0AbCdefG
|
||||
default['fail2ban']['slack_webhook'] = nil
|
||||
# Then setting the Slack channel name without the hashtag (#)
|
||||
default['fail2ban']['slack_channel'] = 'general'
|
||||
|
||||
# Using attributes to specify the fail2ban filters is now deprecated in favor
|
||||
# of the fail2ban_filter resource which provides a more Chef native way of defining
|
||||
# individual filters in recipes using resources
|
||||
# format: { name: { failregex: '', ignoreregex: ''} }
|
||||
default['fail2ban']['filters'] = {}
|
||||
|
||||
case node['platform_family']
|
||||
when 'rhel', 'fedora', 'amazon'
|
||||
default['fail2ban']['auth_log'] = '/var/log/secure'
|
||||
when 'debian'
|
||||
default['fail2ban']['auth_log'] = '/var/log/auth.log'
|
||||
end
|
||||
|
||||
# Using attributes to specify the fail2ban jails is now deprecated in favor
|
||||
# of the fail2ban_filter resource which provides a more Chef native way of defining
|
||||
# individual filters in recipes using resources
|
||||
default['fail2ban']['services'] = {
|
||||
'ssh' => {
|
||||
'enabled' => 'true',
|
||||
'port' => 'ssh',
|
||||
'filter' => 'sshd',
|
||||
'logpath' => node['fail2ban']['auth_log'],
|
||||
'maxretry' => '6',
|
||||
},
|
||||
}
|
||||
|
||||
if platform_family?('rhel', 'fedora', 'amazon')
|
||||
default['fail2ban']['services']['ssh-iptables'] = {
|
||||
'enabled' => false,
|
||||
}
|
||||
end
|
||||
|
|
@ -0,0 +1,115 @@
|
|||
# Put files/directories that should be ignored in this file when uploading
|
||||
# to a Chef Infra Server or Supermarket.
|
||||
# Lines that start with '# ' are comments.
|
||||
|
||||
# OS generated files #
|
||||
######################
|
||||
.DS_Store
|
||||
ehthumbs.db
|
||||
Icon?
|
||||
nohup.out
|
||||
Thumbs.db
|
||||
.envrc
|
||||
|
||||
# EDITORS #
|
||||
###########
|
||||
.#*
|
||||
.project
|
||||
.settings
|
||||
*_flymake
|
||||
*_flymake.*
|
||||
*.bak
|
||||
*.sw[a-z]
|
||||
*.tmproj
|
||||
*~
|
||||
\#*
|
||||
REVISION
|
||||
TAGS*
|
||||
tmtags
|
||||
.vscode
|
||||
.editorconfig
|
||||
|
||||
## COMPILED ##
|
||||
##############
|
||||
*.class
|
||||
*.com
|
||||
*.dll
|
||||
*.exe
|
||||
*.o
|
||||
*.pyc
|
||||
*.so
|
||||
*/rdoc/
|
||||
a.out
|
||||
mkmf.log
|
||||
|
||||
# Testing #
|
||||
###########
|
||||
.circleci/*
|
||||
.codeclimate.yml
|
||||
.delivery/*
|
||||
.foodcritic
|
||||
.kitchen*
|
||||
.mdlrc
|
||||
.overcommit.yml
|
||||
.rspec
|
||||
.rubocop.yml
|
||||
.travis.yml
|
||||
.watchr
|
||||
.yamllint
|
||||
azure-pipelines.yml
|
||||
Dangerfile
|
||||
examples/*
|
||||
features/*
|
||||
Guardfile
|
||||
kitchen.yml*
|
||||
mlc_config.json
|
||||
Procfile
|
||||
Rakefile
|
||||
spec/*
|
||||
test/*
|
||||
|
||||
# SCM #
|
||||
#######
|
||||
.git
|
||||
.gitattributes
|
||||
.gitconfig
|
||||
.github/*
|
||||
.gitignore
|
||||
.gitkeep
|
||||
.gitmodules
|
||||
.svn
|
||||
*/.bzr/*
|
||||
*/.git
|
||||
*/.hg/*
|
||||
*/.svn/*
|
||||
|
||||
# Berkshelf #
|
||||
#############
|
||||
Berksfile
|
||||
Berksfile.lock
|
||||
cookbooks/*
|
||||
tmp
|
||||
|
||||
# Bundler #
|
||||
###########
|
||||
vendor/*
|
||||
Gemfile
|
||||
Gemfile.lock
|
||||
|
||||
# Policyfile #
|
||||
##############
|
||||
Policyfile.rb
|
||||
Policyfile.lock.json
|
||||
|
||||
# Documentation #
|
||||
#############
|
||||
CODE_OF_CONDUCT*
|
||||
CONTRIBUTING*
|
||||
documentation/*
|
||||
TESTING*
|
||||
UPGRADING*
|
||||
|
||||
# Vagrant #
|
||||
###########
|
||||
.vagrant
|
||||
Vagrantfile
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
---
|
||||
driver:
|
||||
name: dokken
|
||||
privileged: true # because Docker and SystemD/Upstart
|
||||
chef_version: <%= ENV['CHEF_VERSION'] || 'current' %>
|
||||
|
||||
transport:
|
||||
name: dokken
|
||||
|
||||
provisioner:
|
||||
name: dokken
|
||||
deprecations_as_errors: true
|
||||
chef_license: accept-no-persist
|
||||
|
||||
verifier:
|
||||
name: inspec
|
||||
|
||||
platforms:
|
||||
- name: amazonlinux-2
|
||||
driver:
|
||||
image: dokken/amazonlinux-2
|
||||
pid_one_command: /usr/lib/systemd/systemd
|
||||
|
||||
- name: debian-9
|
||||
driver:
|
||||
image: dokken/debian-9
|
||||
pid_one_command: /bin/systemd
|
||||
intermediate_instructions:
|
||||
- RUN /usr/bin/apt-get update
|
||||
|
||||
- name: debian-10
|
||||
driver:
|
||||
image: dokken/debian-10
|
||||
pid_one_command: /bin/systemd
|
||||
intermediate_instructions:
|
||||
- RUN /usr/bin/apt-get update
|
||||
|
||||
- name: centos-7
|
||||
driver:
|
||||
image: dokken/centos-7
|
||||
pid_one_command: /usr/lib/systemd/systemd
|
||||
|
||||
- name: centos-8
|
||||
driver:
|
||||
image: dokken/centos-8
|
||||
pid_one_command: /usr/lib/systemd/systemd
|
||||
|
||||
- name: fedora-latest
|
||||
driver:
|
||||
image: dokken/fedora-latest
|
||||
pid_one_command: /usr/lib/systemd/systemd
|
||||
|
||||
- name: ubuntu-18.04
|
||||
driver:
|
||||
image: dokken/ubuntu-18.04
|
||||
pid_one_command: /bin/systemd
|
||||
intermediate_instructions:
|
||||
- RUN /usr/bin/apt-get update
|
||||
|
||||
- name: ubuntu-20.04
|
||||
driver:
|
||||
image: dokken/ubuntu-20.04
|
||||
pid_one_command: /bin/systemd
|
||||
intermediate_instructions:
|
||||
- RUN /usr/bin/apt-get update
|
||||
|
||||
- name: opensuse-leap-15
|
||||
driver:
|
||||
image: dokken/opensuse-leap-15
|
||||
pid_one_command: /usr/lib/systemd/systemd
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
{
|
||||
"name": "fail2ban",
|
||||
"description": "Installs and configures fail2ban",
|
||||
"long_description": "",
|
||||
"maintainer": "Sous-Chefs",
|
||||
"maintainer_email": "help@sous-chefs.org",
|
||||
"license": "Apache-2.0",
|
||||
"platforms": {
|
||||
"amazon": ">= 0.0.0",
|
||||
"centos": ">= 0.0.0",
|
||||
"debian": ">= 0.0.0",
|
||||
"fedora": ">= 0.0.0",
|
||||
"oracle": ">= 0.0.0",
|
||||
"redhat": ">= 0.0.0",
|
||||
"scientific": ">= 0.0.0",
|
||||
"ubuntu": ">= 0.0.0",
|
||||
"suse": ">= 0.0.0",
|
||||
"opensuseleap": ">= 0.0.0"
|
||||
},
|
||||
"dependencies": {
|
||||
"yum-epel": ">= 0.0.0"
|
||||
},
|
||||
"providing": {
|
||||
|
||||
},
|
||||
"recipes": {
|
||||
|
||||
},
|
||||
"version": "7.0.4",
|
||||
"source_url": "https://github.com/chef-cookbooks/fail2ban",
|
||||
"issues_url": "https://github.com/chef-cookbooks/fail2ban/issues",
|
||||
"privacy": false,
|
||||
"chef_versions": [
|
||||
[
|
||||
">= 15.3"
|
||||
]
|
||||
],
|
||||
"ohai_versions": [
|
||||
|
||||
],
|
||||
"gems": [
|
||||
|
||||
],
|
||||
"eager_load_libraries": true
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
name 'fail2ban'
|
||||
maintainer 'Sous-Chefs'
|
||||
maintainer_email 'help@sous-chefs.org'
|
||||
license 'Apache-2.0'
|
||||
description 'Installs and configures fail2ban'
|
||||
version '7.0.4'
|
||||
source_url 'https://github.com/chef-cookbooks/fail2ban'
|
||||
issues_url 'https://github.com/chef-cookbooks/fail2ban/issues'
|
||||
chef_version '>= 15.3'
|
||||
|
||||
depends 'yum-epel'
|
||||
|
||||
%w(amazon centos debian fedora oracle redhat scientific ubuntu suse opensuseleap ).each do |os|
|
||||
supports os
|
||||
end
|
||||
|
|
@ -0,0 +1,97 @@
|
|||
#
|
||||
# Cookbook:: fail2ban
|
||||
# Recipe:: default
|
||||
#
|
||||
# Copyright:: 2009-2018, Chef Software, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
# epel repository is needed for the fail2ban package on rhel
|
||||
include_recipe 'yum-epel' if platform_family?('rhel', 'amazon')
|
||||
|
||||
package 'fail2ban' do
|
||||
action :install
|
||||
notifies :reload, 'ohai[reload package list]', :immediately
|
||||
end
|
||||
|
||||
if node['fail2ban']['slack_webhook']
|
||||
package 'curl' do
|
||||
action :install
|
||||
notifies :reload, 'ohai[reload package list]', :immediately
|
||||
end
|
||||
end
|
||||
|
||||
ohai 'reload package list' do
|
||||
plugin 'packages'
|
||||
action :nothing
|
||||
end
|
||||
|
||||
node['fail2ban']['filters'].each do |name, options|
|
||||
template "/etc/fail2ban/filter.d/#{name}.conf" do
|
||||
source 'filter.conf.erb'
|
||||
variables(
|
||||
failregex: [options['failregex']].flatten,
|
||||
ignoreregex: [options['ignoreregex']].flatten
|
||||
)
|
||||
notifies :restart, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
||||
template '/etc/fail2ban/fail2ban.conf' do
|
||||
source 'fail2ban.conf.erb'
|
||||
notifies :restart, 'service[fail2ban]'
|
||||
end
|
||||
|
||||
template '/etc/fail2ban/jail.local' do
|
||||
source 'jail.conf.erb'
|
||||
variables(
|
||||
slack_webhook: node['fail2ban']['slack_webhook']
|
||||
)
|
||||
notifies :restart, 'service[fail2ban]'
|
||||
end
|
||||
|
||||
if node['fail2ban']['slack_webhook']
|
||||
template '/etc/fail2ban/action.d/slack.conf' do
|
||||
source 'slack.conf.erb'
|
||||
notifies :restart, 'service[fail2ban]'
|
||||
end
|
||||
|
||||
template '/etc/fail2ban/slack_notify.sh' do
|
||||
source 'slack_notify.sh.erb'
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '0750'
|
||||
variables(
|
||||
slack_channel: node['fail2ban']['slack_channel'],
|
||||
slack_webhook: node['fail2ban']['slack_webhook']
|
||||
)
|
||||
notifies :restart, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
||||
file '/etc/fail2ban/jail.d/defaults-debian.conf' do
|
||||
action 'delete'
|
||||
only_if { platform?('ubuntu') }
|
||||
end
|
||||
|
||||
file '/etc/fail2ban/jail.d/00-firewalld.conf' do
|
||||
action 'delete'
|
||||
only_if { platform?('centos') }
|
||||
end
|
||||
|
||||
service 'fail2ban' do
|
||||
supports [status: true, restart: true]
|
||||
action [:enable, :start] if platform_family?('rhel', 'amazon', 'fedora')
|
||||
action [:enable] if platform_family?('debian', 'suse')
|
||||
end
|
||||
|
|
@ -0,0 +1,49 @@
|
|||
#
|
||||
# Cookbook:: fail2ban
|
||||
# Resource:: fail2ban_filter
|
||||
#
|
||||
# Copyright:: 2015, OpenStreetMap Foundation
|
||||
# Copyright:: 2018, Chef Software, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# https://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
property :filter, String, name_property: true
|
||||
property :source, String, default: 'filter.erb'
|
||||
property :cookbook, String, default: 'fail2ban'
|
||||
property :failregex, [String, Array]
|
||||
property :ignoreregex, [String, Array]
|
||||
|
||||
unified_mode true
|
||||
|
||||
action :create do
|
||||
template "/etc/fail2ban/filter.d/#{new_resource.filter}.conf" do
|
||||
cookbook new_resource.cookbook
|
||||
source new_resource.source
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '0644'
|
||||
variables(
|
||||
failregex: new_resource.failregex,
|
||||
ignoreregex: new_resource.ignoreregex
|
||||
)
|
||||
notifies :reload, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
||||
action :delete do
|
||||
file "/etc/fail2ban/filter.d/#{new_resource.filter}.conf" do
|
||||
action :delete
|
||||
notifies :reload, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
#
|
||||
# Cookbook:: fail2ban
|
||||
# Resource:: fail2ban_jail
|
||||
#
|
||||
# Copyright:: 2015, OpenStreetMap Foundation
|
||||
# Copyright:: 2018, Chef Software, Inc.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# https://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
|
||||
property :bantime, [Integer, String]
|
||||
property :cookbook, String, default: 'fail2ban'
|
||||
property :filter, String
|
||||
property :ignoreips, Array
|
||||
property :jail, String, name_property: true
|
||||
property :logpath, String
|
||||
property :maxretry, Integer
|
||||
property :ports, Array, default: []
|
||||
property :priority, [String, Integer], default: '50'
|
||||
property :protocol, String
|
||||
property :source, String, default: 'jail.erb'
|
||||
|
||||
unified_mode true
|
||||
|
||||
action :create do
|
||||
template "/etc/fail2ban/jail.d/#{new_resource.priority}-#{new_resource.jail}.conf" do
|
||||
cookbook new_resource.cookbook
|
||||
source new_resource.source
|
||||
owner 'root'
|
||||
group 'root'
|
||||
mode '0644'
|
||||
variables(
|
||||
bantime: new_resource.bantime,
|
||||
filter: new_resource.filter,
|
||||
ignoreips: new_resource.ignoreips,
|
||||
logpath: new_resource.logpath,
|
||||
maxretry: new_resource.maxretry,
|
||||
name: new_resource.jail,
|
||||
ports: new_resource.ports,
|
||||
protocol: new_resource.protocol
|
||||
)
|
||||
notifies :reload, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
||||
action :delete do
|
||||
file "/etc/fail2ban/jail.d/#{new_resource.priority}-#{new_resource.jail}.conf" do
|
||||
action :delete
|
||||
notifies :reload, 'service[fail2ban]'
|
||||
end
|
||||
end
|
||||
|
|
@ -0,0 +1,60 @@
|
|||
# DO NOT EDIT - This file is being maintained by Chef Infra
|
||||
|
||||
# Fail2Ban main configuration file
|
||||
#
|
||||
# Comments: use '#' for comment lines and ';' (following a space) for inline comments
|
||||
|
||||
[Definition]
|
||||
|
||||
# Option: loglevel
|
||||
# Notes.: Set the log level output.
|
||||
# CRITICAL
|
||||
# ERROR
|
||||
# WARNING
|
||||
# NOTICE
|
||||
# INFO
|
||||
# DEBUG
|
||||
# Values: [ LEVEL ] Default: ERROR
|
||||
loglevel = <%= node['fail2ban']['loglevel'] %>
|
||||
|
||||
# Option: logtarget
|
||||
# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
|
||||
# Only one log target can be specified.
|
||||
# If you change logtarget from the default value and you are
|
||||
# using logrotate -- also adjust or disable rotation in the
|
||||
# corresponding configuration file
|
||||
# (e.g. /etc/logrotate.d/fail2ban on Debian systems)
|
||||
# Values: [ STDOUT | STDERR | SYSLOG | FILE ] Default: STDERR
|
||||
logtarget = <%= node['fail2ban']['logtarget'] %>
|
||||
|
||||
# Option: syslogsocket
|
||||
# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
|
||||
# auto uses platform.system() to determine predefined paths
|
||||
# Values: [ auto | FILE ] Default: auto
|
||||
syslogsocket = <%= node['fail2ban']['syslogsocket'] %>
|
||||
|
||||
# Option: socket
|
||||
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
|
||||
# not remove this file when Fail2ban runs. It will not be possible to
|
||||
# communicate with the server afterwards.
|
||||
# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.sock
|
||||
socket = <%= node['fail2ban']['socket'] %>
|
||||
|
||||
# Option: pidfile
|
||||
# Notes.: Set the PID file. This is used to store the process ID of the
|
||||
# fail2ban server.
|
||||
# Values: [ FILE ] Default: /var/run/fail2ban/fail2ban.pid
|
||||
pidfile = <%= node['fail2ban']['pidfile'] %>
|
||||
|
||||
# Options: dbfile
|
||||
# Notes.: Set the file for the fail2ban persistent data to be stored.
|
||||
# A value of ":memory:" means database is only stored in memory
|
||||
# and data is lost when fail2ban is stopped.
|
||||
# A value of "None" disables the database.
|
||||
# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
|
||||
dbfile = <%= node['fail2ban']['dbfile'] %>
|
||||
|
||||
# Options: dbpurgeage
|
||||
# Notes.: Sets age at which bans should be purged from the database
|
||||
# Values: [ SECONDS ] Default: 86400 (24hours)
|
||||
dbpurgeage = <%= node['fail2ban']['dbpurgeage'] %>
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
# DO NOT EDIT - This file is being maintained by Chef Infra
|
||||
[Definition]
|
||||
|
||||
failregex = <%= @failregex.join("\n ") %>
|
||||
|
||||
ignoreregex = <%= @ignoreregex.join("\n ") %>
|
||||
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
# DO NOT EDIT - This file is being maintained by Chef Infra
|
||||
|
||||
[Definition]
|
||||
failregex = <%= Array(@failregex).join("\n ") %>
|
||||
ignoreregex = <%= Array(@ignoreregex).join("\n ") %>
|
||||
|
|
@ -0,0 +1,116 @@
|
|||
# DO NOT EDIT - This file is being maintained by Chef Infra
|
||||
|
||||
# Fail2Ban configuration file.
|
||||
#
|
||||
# The configuration here inherits from /etc/fail2ban/jail.conf. Any setting
|
||||
# omitted here will take it's value from that file
|
||||
#
|
||||
# Author: Yaroslav O. Halchenko <debian@onerussian.com>
|
||||
#
|
||||
#
|
||||
|
||||
# The DEFAULT allows a global definition of the options. They can be overridden
|
||||
# in each jail afterwards.
|
||||
|
||||
[DEFAULT]
|
||||
|
||||
# "ignoreip" can be an IP address, a CIDR mask or a DNS host
|
||||
ignoreip = <%= node['fail2ban']['ignoreip'] %>
|
||||
findtime = <%= node['fail2ban']['findtime'] %>
|
||||
bantime = <%= node['fail2ban']['bantime'] %>
|
||||
maxretry = <%= node['fail2ban']['maxretry'] %>
|
||||
|
||||
# "backend" specifies the backend used to get files modification. Available
|
||||
# options are "gamin", "polling" and "auto".
|
||||
# yoh: For some reason Debian shipped python-gamin didn't work as expected
|
||||
# This issue left ToDo, so polling is default backend for now
|
||||
backend = <%= node['fail2ban']['backend'] %>
|
||||
|
||||
#
|
||||
# Destination email address used solely for the interpolations in
|
||||
# jail.{conf,local} configuration files.
|
||||
destemail = <%= node['fail2ban']['email'] %>
|
||||
|
||||
#
|
||||
# Name of the sender for mta actions
|
||||
sendername = <%= node['fail2ban']['sendername'] %>
|
||||
|
||||
#
|
||||
# ACTIONS
|
||||
#
|
||||
|
||||
# Default banning action (e.g. iptables, iptables-new,
|
||||
# iptables-multiport, shorewall, etc) It is used to define
|
||||
# action_* variables. Can be overridden globally or per
|
||||
# section within jail.local file
|
||||
banaction = <%= node['fail2ban']['banaction'] %>
|
||||
|
||||
# email action. Since 0.8.1 upstream fail2ban uses sendmail
|
||||
# MTA for the mailing. Change mta configuration parameter to mail
|
||||
# if you want to revert to conventional 'mail'.
|
||||
mta = <%= node['fail2ban']['mta'] %>
|
||||
|
||||
# Default protocol
|
||||
protocol = <%= node['fail2ban']['protocol'] %>
|
||||
|
||||
# Specify chain where jumps would need to be added in iptables-* actions
|
||||
chain = <%= node['fail2ban']['chain'] %>
|
||||
|
||||
#
|
||||
# Action shortcuts. To be used to define action parameter
|
||||
|
||||
# The simplest action to take: ban only
|
||||
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
|
||||
# ban & send an e-mail with whois report to the destemail.
|
||||
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
|
||||
|
||||
# ban & send an e-mail with whois report and relevant log lines
|
||||
# to the destemail.
|
||||
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
|
||||
|
||||
<% if @slack_webhook %>
|
||||
action_with_slack_notification = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
slack[name=%(__name__)s]
|
||||
<% end %>
|
||||
|
||||
# Choose default action. To change, just override value of 'action' with the
|
||||
# interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local
|
||||
# globally (section [DEFAULT]) or per specific section
|
||||
action = %(<%= @slack_webhook ? 'action_with_slack_notification' : node['fail2ban']['action'] %>)s
|
||||
|
||||
#
|
||||
# JAILS
|
||||
#
|
||||
|
||||
# Next jails can inherit from the configuration in /etc/fail2ban/jail.conf.
|
||||
# Enable any defined in that file jail by including
|
||||
#
|
||||
# [SECTION_NAME]
|
||||
# enabled = true
|
||||
#
|
||||
# Optionally you may override any other parameter (e.g. banaction,
|
||||
# action, port, logpath, etc) in that section within jail.local
|
||||
|
||||
|
||||
<% @node['fail2ban']['services'].each do |service, param| %>
|
||||
[<%= service %>]
|
||||
|
||||
enabled = <%= param['enabled'] %>
|
||||
<% %w{ port filter logpath findtime bantime maxretry protocol banaction backend ignorecommand }.each do |key| %>
|
||||
<% if param[key] %>
|
||||
<%=key%> = <%= param[key] %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
<% if param['action'] %>
|
||||
<% if param['action'] =~ /action_/ %>
|
||||
action = %(<%= param['action'] %>)s
|
||||
<% else %>
|
||||
action = <%= param['action'] %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
|
||||
<% end %>
|
||||
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# DO NOT EDIT - This file is being maintained by Chef Infra
|
||||
|
||||
[<%= @name %>]
|
||||
enabled = true
|
||||
<% if @protocol -%>
|
||||
protocol = <%= @protocol %>
|
||||
<% end -%>
|
||||
<% unless @ports.empty? -%>
|
||||
port = <%= @ports.join(",") %>
|
||||
<% end -%>
|
||||
filter = <%= @filter %>
|
||||
<% if @logpath -%>
|
||||
logpath = <%= @logpath %>
|
||||
<% end -%>
|
||||
<% if @maxretry -%>
|
||||
maxretry = <%= @maxretry %>
|
||||
<% end -%>
|
||||
<% if @ignoreips -%>
|
||||
ignoreip = <%= @ignoreips.sort.join(" ") %>
|
||||
<% end -%>
|
||||
<% if @bantime -%>
|
||||
bantime = <%= @bantime %>
|
||||
<% end -%>
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
[Definition]
|
||||
|
||||
actionban = /bin/bash /etc/fail2ban/slack_notify.sh "Banned _country_ <ip> in the jail <name> after <failures> attempts" "<ip>" > /dev/null 2>&1
|
||||
actionunban = /bin/bash /etc/fail2ban/slack_notify.sh "Unbanned _country_ <ip> in the jail <name>" "<ip>" > /dev/null 2>&1
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
#!/bin/bash
|
||||
|
||||
# message first command argument
|
||||
MESSAGE=$1
|
||||
HOOK_URL=<%= @slack_webhook %>
|
||||
HOST=$(hostname)
|
||||
|
||||
CHANNEL="#<%= @slack_channel %>"
|
||||
USERNAME="fail2ban"
|
||||
ICON=":cop:"
|
||||
|
||||
# ip second command argument
|
||||
IP=$2
|
||||
# lets find out from what country we have our hacker
|
||||
COUNTRY=$(curl ipinfo.io/${IP}/country)
|
||||
# converting country to lover case. I love you bash script =\
|
||||
COUNTRY=$(echo "$COUNTRY" | tr -s '[:upper:]' '[:lower:]')
|
||||
# slack emoji
|
||||
COUNTRY=":flag-$COUNTRY:"
|
||||
|
||||
# replace _country_ template to the country emoji
|
||||
MESSAGE="${MESSAGE/_country_/$COUNTRY}"
|
||||
|
||||
curl -X POST --data-urlencode "payload={\"channel\": \"${CHANNEL}\", \"username\": \"${USERNAME}\", \"text\": \"[${HOST}] ${MESSAGE}\", \"icon_emoji\": \"${ICON}\"}" ${HOOK_URL}
|
||||
|
||||
exit 0
|
||||
|
|
@ -71,10 +71,9 @@
|
|||
"recipe[kosmos_kvm::backup]",
|
||||
"recipe[kosmos-ejabberd::firewall]",
|
||||
"recipe[kosmos-ipfs::firewall_swarm]",
|
||||
"recipe[kosmos-ipfs::firewall_public_gateway]",
|
||||
"recipe[kosmos-bitcoin::firewall]",
|
||||
"recipe[kosmos_zerotier::firewall]",
|
||||
"recipe[kosmos-nginx::firewall]",
|
||||
"recipe[sockethub::firewall]"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -35,6 +35,7 @@
|
|||
"kosmos-akkounts::nginx_api",
|
||||
"kosmos-hubot::nginx_botka_irc-libera-chat",
|
||||
"kosmos-hubot::nginx_hal8000_xmpp",
|
||||
"kosmos-ipfs::nginx_public_gateway",
|
||||
"remotestorage_discourse::nginx",
|
||||
"kosmos_zerotier::controller",
|
||||
"kosmos_zerotier::firewall",
|
||||
|
|
@ -66,7 +67,10 @@
|
|||
"discourse::nginx",
|
||||
"git::default",
|
||||
"git::package",
|
||||
"kosmos-base::letsencrypt"
|
||||
"kosmos-base::letsencrypt",
|
||||
"firewall::default",
|
||||
"chef-sugar::default",
|
||||
"fail2ban::default"
|
||||
],
|
||||
"platform": "ubuntu",
|
||||
"platform_version": "20.04",
|
||||
|
|
|
|||
|
|
@ -12,7 +12,8 @@
|
|||
"hostname": "ipfs-1",
|
||||
"ipaddress": "192.168.122.195",
|
||||
"roles": [
|
||||
"kvm_guest"
|
||||
"kvm_guest",
|
||||
"ipfs_gateway"
|
||||
],
|
||||
"recipes": [
|
||||
"kosmos-base",
|
||||
|
|
@ -20,7 +21,6 @@
|
|||
"kosmos_kvm::guest",
|
||||
"kosmos-ipfs",
|
||||
"kosmos-ipfs::default",
|
||||
"kosmos-ipfs::public_gateway",
|
||||
"kosmos-ipfs::kredits_pinner",
|
||||
"apt::default",
|
||||
"timezone_iii::default",
|
||||
|
|
@ -43,19 +43,7 @@
|
|||
"kosmos-nodejs::default",
|
||||
"nodejs::nodejs_from_package",
|
||||
"nodejs::repo",
|
||||
"kosmos-ipfs::firewall_swarm",
|
||||
"kosmos-nginx::default",
|
||||
"nginx::default",
|
||||
"nginx::package",
|
||||
"nginx::ohai_plugin",
|
||||
"nginx::repo",
|
||||
"nginx::commons",
|
||||
"nginx::commons_dir",
|
||||
"nginx::commons_script",
|
||||
"nginx::commons_conf",
|
||||
"kosmos-nginx::firewall",
|
||||
"kosmos-ipfs::firewall_public_gateway",
|
||||
"kosmos-base::letsencrypt"
|
||||
"kosmos-ipfs::firewall_swarm"
|
||||
],
|
||||
"platform": "ubuntu",
|
||||
"platform_version": "20.04",
|
||||
|
|
@ -76,4 +64,4 @@
|
|||
"role[kvm_guest]",
|
||||
"role[ipfs_gateway]"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
@ -2,7 +2,6 @@ name "ipfs_gateway"
|
|||
|
||||
default_run_list = %w(
|
||||
kosmos-ipfs
|
||||
kosmos-ipfs::public_gateway
|
||||
kosmos-ipfs::kredits_pinner
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -10,6 +10,7 @@ default_run_list = %w(
|
|||
kosmos-akkounts::nginx_api
|
||||
kosmos-hubot::nginx_botka_irc-libera-chat
|
||||
kosmos-hubot::nginx_hal8000_xmpp
|
||||
kosmos-ipfs::nginx_public_gateway
|
||||
remotestorage_discourse::nginx
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,12 +1,19 @@
|
|||
node.normal['ipfs']['version'] = "0.15.0"
|
||||
node.normal['ipfs']['checksum'] = "5830ce226956c5e2a2de3a3440704402dd3501c43ec16eeec2d61491317005f2"
|
||||
|
||||
node.default['kosmos-ipfs']['api']['port'] = 5001
|
||||
node.default['kosmos-ipfs']['swarm_p2p_port'] = 4001
|
||||
node.default['kosmos-ipfs']['api_port'] = 5001
|
||||
node.default['kosmos-ipfs']['gateway_port'] = 9090
|
||||
|
||||
node.default['kosmos-ipfs']['ipfs']['config'] = {
|
||||
# The default gateway is already used by kosmos' hubot (8080)
|
||||
"Addresses.Gateway" => "/ip4/127.0.0.1/tcp/9090",
|
||||
"Addresses.Gateway" => "/ip4/0.0.0.0/tcp/#{node['kosmos-ipfs']['gateway_port']}",
|
||||
# API with Web UI
|
||||
"Addresses.API" => "/ip4/0.0.0.0/tcp/5001",
|
||||
"Addresses.API" => "/ip4/0.0.0.0/tcp/#{node['kosmos-ipfs']['api_port']}",
|
||||
# Do not fetch/serve anything not pinned/cached on our node
|
||||
"Gateway.NoFetch" => true,
|
||||
# Act as DHT client only
|
||||
"Routing.Type" => "dhtclient",
|
||||
# Enable bandwith metrics
|
||||
'Swarm.DisableBandwidthMetrics' => false,
|
||||
# Disable the p2p-circuit relay transport
|
||||
|
|
@ -52,10 +59,7 @@ node.default['kosmos-ipfs']['ipfs']['config'] = {
|
|||
'/ip4/240.0.0.0/ipcidr/4'],
|
||||
}
|
||||
|
||||
node.default['kosmos-ipfs']['nginx']['api_port'] = 5001
|
||||
node.default['kosmos-ipfs']['nginx']['gateway_port'] = 9090
|
||||
node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
|
||||
node.default['kosmos-ipfs']['nginx']['swarm_p2p_port'] = 4001
|
||||
node.default['kosmos-ipfs']['nginx']['domain'] = "ipfs.kosmos.org"
|
||||
node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
|
||||
|
||||
node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.1.0"
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
|
|||
version '0.3.0'
|
||||
|
||||
depends 'ipfs'
|
||||
depends 'fail2ban'
|
||||
depends 'kosmos-base'
|
||||
depends 'kosmos-nginx'
|
||||
depends 'kosmos-nodejs'
|
||||
|
|
|
|||
|
|
@ -18,7 +18,14 @@ unless node.chef_environment == "development"
|
|||
end
|
||||
|
||||
firewall_rule 'ipfs_api' do
|
||||
port node['kosmos-ipfs']['api']['port']
|
||||
port node['kosmos-ipfs']['api_port']
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
|
||||
firewall_rule 'ipfs_gateway' do
|
||||
port node['kosmos-ipfs']['gateway_port']
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
|
|
|
|||
|
|
@ -1,11 +0,0 @@
|
|||
#
|
||||
# Cookbook Name:: kosmos-ipfs
|
||||
# Recipe:: firewall_public_gateway
|
||||
#
|
||||
|
||||
include_recipe 'firewall'
|
||||
firewall_rule 'ipfs_api' do
|
||||
port node['kosmos-ipfs']['nginx']['external_api_port']
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
|
|
@ -5,7 +5,7 @@
|
|||
|
||||
include_recipe 'firewall'
|
||||
firewall_rule 'ipfs_swarm_p2p' do
|
||||
port node['kosmos-ipfs']['nginx']['swarm_p2p_port']
|
||||
port node['kosmos-ipfs']['swarm_p2p_port']
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
|
|
|
|||
|
|
@ -0,0 +1,61 @@
|
|||
#
|
||||
# Cookbook Name:: kosmos-ipfs
|
||||
# Recipe:: nginx_public_gateway
|
||||
#
|
||||
|
||||
include_recipe "kosmos-nginx"
|
||||
include_recipe 'firewall'
|
||||
|
||||
domain = node["kosmos-ipfs"]["nginx"]["domain"]
|
||||
|
||||
ipfs_node_ip_addresses = []
|
||||
search(:node, "role:ipfs_gateway").each do |node|
|
||||
ipfs_node_ip_addresses << node["knife_zero"]["host"]
|
||||
end
|
||||
|
||||
nginx_certbot_site domain
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
|
||||
source "nginx_conf_#{domain}.erb"
|
||||
owner 'www-data'
|
||||
mode 0640
|
||||
variables server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
|
||||
ipfs_api_port: node['kosmos-ipfs']['api_port'],
|
||||
ipfs_gateway_port: node['kosmos-ipfs']['gateway_port'],
|
||||
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port'],
|
||||
upstream_hosts: ipfs_node_ip_addresses
|
||||
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
nginx_site domain do
|
||||
action :enable
|
||||
end
|
||||
|
||||
firewall_rule 'ipfs_api' do
|
||||
port node['kosmos-ipfs']['nginx']['external_api_port']
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
|
||||
node.normal['fail2ban']['filters'] = {
|
||||
'nginx-ipfs-404' => {
|
||||
'failregex' => ['^<HOST> -.*"(GET|POST|PUT|DELETE|OPTIONS|HEAD).*HTTP.*" 404'],
|
||||
'ignoreregex' => []
|
||||
}
|
||||
}
|
||||
|
||||
node.normal['fail2ban']['services'] = {
|
||||
'nginx-ipfs' => {
|
||||
'enabled' => 'true',
|
||||
'filter' => 'nginx-ipfs-404',
|
||||
'logpath' => "/var/log/nginx/#{domain}.access.log",
|
||||
'maxretry' => '10',
|
||||
'bantime' => '1440m',
|
||||
'findtime' => '1440m'
|
||||
}
|
||||
}
|
||||
|
||||
include_recipe "fail2ban"
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
#
|
||||
# Cookbook Name:: kosmos-ipfs
|
||||
# Recipe:: public_gateway
|
||||
#
|
||||
# The MIT License (MIT)
|
||||
#
|
||||
# Copyright:: 2019, Kosmos Developers
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in
|
||||
# all copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
include_recipe "kosmos-nginx"
|
||||
|
||||
domain = node["kosmos-ipfs"]["nginx"]["domain"]
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
|
||||
source "nginx_conf_#{domain}.erb"
|
||||
owner 'www-data'
|
||||
mode 0640
|
||||
variables server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
|
||||
ipfs_api_port: node['kosmos-ipfs']['nginx']['api_port'],
|
||||
ipfs_gateway_port: node['kosmos-ipfs']['nginx']['gateway_port'],
|
||||
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port']
|
||||
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
nginx_site domain do
|
||||
action :enable
|
||||
end
|
||||
|
||||
nginx_certbot_site domain
|
||||
|
||||
unless node.chef_environment == "development"
|
||||
include_recipe "kosmos-ipfs::firewall_public_gateway"
|
||||
end
|
||||
|
|
@ -1,21 +1,27 @@
|
|||
upstream _ipfs_gateway {
|
||||
server localhost:<%= @ipfs_gateway_port %>;
|
||||
<% @upstream_hosts.each do |host| %>
|
||||
server <%= host %>:<%= @ipfs_gateway_port %>;
|
||||
<% end %>
|
||||
}
|
||||
upstream _ipfs_api {
|
||||
server localhost:<%= @ipfs_api_port %>;
|
||||
<% @upstream_hosts.each do |host| %>
|
||||
server <%= host %>:<%= @ipfs_api_port %>;
|
||||
<% end %>
|
||||
}
|
||||
|
||||
limit_req_zone $binary_remote_addr zone=ipfsgateway:10m rate=10r/s;
|
||||
|
||||
server {
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
listen 443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
<% else -%>
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
<% end -%>
|
||||
|
||||
server_name ipfs.kosmos.org;
|
||||
|
||||
access_log /var/log/nginx/<%= @server_name %>.access.log;
|
||||
error_log /var/log/nginx/<%= @server_name %>.error.log;
|
||||
|
||||
location /ipfs {
|
||||
limit_req zone=ipfsgateway burst=20 nodelay;
|
||||
proxy_pass http://_ipfs_gateway/ipfs;
|
||||
}
|
||||
|
||||
|
|
@ -32,6 +38,9 @@ server {
|
|||
|
||||
server_name <%= @server_name %>;
|
||||
|
||||
access_log /var/log/nginx/<%= @server_name %>.access.log;
|
||||
error_log /var/log/nginx/<%= @server_name %>.error.log;
|
||||
|
||||
location / {
|
||||
return 200 'Nothing to see here';
|
||||
add_header Content-Type text/plain;
|
||||
|
|
|
|||
Loading…
Reference in New Issue