mirror of
https://github.com/wahyd4/home-docker.git
synced 2026-08-09 04:15:52 +10:00
142 lines
3.7 KiB
Terraform
142 lines
3.7 KiB
Terraform
# Fail2ban Installation and Configuration
|
|
# Protects SSH (port 22422) and other services from brute force attacks
|
|
|
|
resource "ssh_resource" "fail2ban_install" {
|
|
depends_on = [ssh_resource.k3s_install]
|
|
|
|
host = local.ssh_host
|
|
user = local.ssh_user
|
|
port = local.ssh_port
|
|
private_key = local.ssh_private_key
|
|
timeout = "10m"
|
|
|
|
when = "create"
|
|
|
|
commands = [
|
|
"echo 'Installing fail2ban...'",
|
|
"sudo apt-get update",
|
|
"sudo DEBIAN_FRONTEND=noninteractive apt-get install -y fail2ban",
|
|
"echo 'fail2ban installed successfully'"
|
|
]
|
|
}
|
|
|
|
resource "ssh_resource" "fail2ban_config" {
|
|
depends_on = [ssh_resource.fail2ban_install]
|
|
|
|
host = local.ssh_host
|
|
user = local.ssh_user
|
|
port = local.ssh_port
|
|
private_key = local.ssh_private_key
|
|
timeout = "5m"
|
|
|
|
when = "create"
|
|
|
|
commands = [
|
|
"echo 'Configuring fail2ban...'",
|
|
|
|
# Create local jail configuration for SSH on custom port 22422
|
|
<<-EOT
|
|
cat << 'EOF' | sudo tee /etc/fail2ban/jail.local
|
|
[DEFAULT]
|
|
# Ban hosts for 1 hour (3600 seconds)
|
|
bantime = 3600
|
|
|
|
# A host is banned if it has generated "maxretry" during the last "findtime" seconds
|
|
findtime = 600
|
|
maxretry = 5
|
|
|
|
# Email notifications (optional - configure if needed)
|
|
# destemail = me@junv.cc
|
|
# sender = fail2ban@junv.cc
|
|
# action = %(action_mwl)s
|
|
|
|
# Ignore local network
|
|
ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = 22422
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
findtime = 600
|
|
|
|
[sshd-ddos]
|
|
enabled = true
|
|
port = 22422
|
|
filter = sshd-ddos
|
|
logpath = /var/log/auth.log
|
|
maxretry = 10
|
|
bantime = 7200
|
|
findtime = 600
|
|
|
|
[recidive]
|
|
enabled = true
|
|
logpath = /var/log/fail2ban.log
|
|
bantime = 86400
|
|
findtime = 86400
|
|
maxretry = 3
|
|
|
|
EOF
|
|
EOT
|
|
,
|
|
|
|
# Create custom filter for Kubernetes-related attacks (optional)
|
|
<<-EOT
|
|
cat << 'EOF' | sudo tee /etc/fail2ban/filter.d/k8s-api.conf
|
|
[Definition]
|
|
failregex = ^.*"remote_addr":"<HOST>".*"status":(?:401|403).*$
|
|
ignoreregex =
|
|
EOF
|
|
EOT
|
|
,
|
|
|
|
# Enable and start fail2ban service
|
|
"sudo systemctl enable fail2ban",
|
|
"sudo systemctl restart fail2ban",
|
|
|
|
# Wait for fail2ban to start
|
|
"sleep 5",
|
|
|
|
# Verify fail2ban is running
|
|
"sudo systemctl is-active fail2ban",
|
|
|
|
"echo '✅ fail2ban configured and started successfully!'"
|
|
]
|
|
}
|
|
|
|
# Output fail2ban status information
|
|
output "fail2ban_info" {
|
|
depends_on = [ssh_resource.fail2ban_config]
|
|
|
|
value = <<-EOT
|
|
Fail2ban deployed successfully!
|
|
|
|
Configuration:
|
|
- ✅ SSH protection on port 22422
|
|
- ✅ Ban time: 1 hour (3600 seconds)
|
|
- ✅ Max retries: 5 attempts in 10 minutes
|
|
- ✅ Recidive jail: 24 hour ban for repeat offenders
|
|
- ✅ Ignored IPs: 192.168.1.0/24 (local network)
|
|
|
|
Useful Commands:
|
|
- Status: ssh -p 22422 junv@192.168.1.2 "sudo fail2ban-client status"
|
|
- SSH jail status: ssh -p 22422 junv@192.168.1.2 "sudo fail2ban-client status sshd"
|
|
- List banned IPs: ssh -p 22422 junv@192.168.1.2 "sudo fail2ban-client status sshd | grep 'Banned IP'"
|
|
- Unban IP: ssh -p 22422 junv@192.168.1.2 "sudo fail2ban-client set sshd unbanip <IP>"
|
|
- View logs: ssh -p 22422 junv@192.168.1.2 "sudo tail -f /var/log/fail2ban.log"
|
|
|
|
Integration with CrowdSec:
|
|
- Both fail2ban and CrowdSec monitor /var/log/auth.log
|
|
- fail2ban provides immediate local protection
|
|
- CrowdSec provides community intelligence and advanced scenarios
|
|
- They work together without conflicts
|
|
|
|
Configuration files:
|
|
- Main config: /etc/fail2ban/jail.local
|
|
- Filters: /etc/fail2ban/filter.d/
|
|
- Actions: /etc/fail2ban/action.d/
|
|
EOT
|
|
}
|