sami
99 lines
2.4 KiB
Bash
Executable File
99 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Install shared-bans client on a server.
|
|
# Run as root on the target server.
|
|
set -euo pipefail
|
|
|
|
REPO_URL="${1:-}"
|
|
if [ -z "$REPO_URL" ]; then
|
|
echo "Usage: $0 <repo-url-with-token>"
|
|
echo "Example: $0 'http://shared-bans-reader:TOKEN@100.81.59.99:3030/sami7777/shared-bans.git'"
|
|
exit 1
|
|
fi
|
|
|
|
# Install scripts
|
|
install -m 0755 scripts/shared-bans-apply.sh /usr/local/bin/shared-bans-apply.sh
|
|
install -m 0755 scripts/shared-bans-update-static.sh /usr/local/bin/shared-bans-update-static.sh
|
|
install -m 0755 scripts/shared-bans-stage-ban.sh /usr/local/bin/shared-bans-stage-ban.sh
|
|
install -m 0644 scripts/fail2ban-action-shared-bans.conf /etc/fail2ban/action.d/shared-bans.conf
|
|
|
|
# Config
|
|
cat > /etc/shared-bans.conf <<EOF
|
|
SHARED_BANS_REPO_URL="$REPO_URL"
|
|
EOF
|
|
chmod 0600 /etc/shared-bans.conf
|
|
|
|
# Systemd units
|
|
cat > /etc/systemd/system/shared-bans-apply.service <<'EOF'
|
|
[Unit]
|
|
Description=Apply shared IP ban list from git repo to local ipset
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/shared-bans-apply.sh
|
|
EOF
|
|
|
|
cat > /etc/systemd/system/shared-bans-apply.timer <<'EOF'
|
|
[Unit]
|
|
Description=Apply shared IP ban list from git repo to local ipset
|
|
|
|
[Timer]
|
|
OnBootSec=2min
|
|
OnUnitActiveSec=5min
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
|
|
cat > /etc/systemd/system/shared-bans-update-static.service <<'EOF'
|
|
[Unit]
|
|
Description=Update shared IP ban list static sources from URLs
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/usr/local/bin/shared-bans-update-static.sh
|
|
EOF
|
|
|
|
cat > /etc/systemd/system/shared-bans-update-static.timer <<'EOF'
|
|
[Unit]
|
|
Description=Nightly update of shared IP ban list static sources
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 03:30:00
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable --now shared-bans-apply.timer shared-bans-update-static.timer
|
|
|
|
# fail2ban jail update
|
|
mkdir -p /var/lib/shared-bans-staging
|
|
|
|
if command -v nft >/dev/null 2>&1 && systemctl is-active nftables >/dev/null 2>&1; then
|
|
FW_ACTION='nftables-multiport[name=sshd, port="22", protocol=tcp]'
|
|
else
|
|
FW_ACTION='iptables-multiport[name=sshd, port="22", protocol=tcp]'
|
|
fi
|
|
|
|
cat > /etc/fail2ban/jail.local <<EOF
|
|
[DEFAULT]
|
|
bantime = 86400
|
|
findtime = 600
|
|
maxretry = 3
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = 22
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
action = $FW_ACTION
|
|
shared-bans[name=sshd]
|
|
EOF
|
|
|
|
systemctl restart fail2ban
|
|
|
|
echo "Installed. Run /usr/local/bin/shared-bans-apply.sh to verify."
|