YunoHost/yunohost
1
0
Fork 0
mirror of https://github.com/YunoHost/yunohost.git synced 2024-09-03 20:06:10 +02:00
Code Issues Projects Releases Packages Wiki Activity

Update fail2ban helpers from experimental helpers.

Browse source
This commit is contained in:
Maniack Crudelis 2018-08-27 21:51:36 +02:00 • committed by GitHub
parent 561f1aecb0
commit 7752bc0fb7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 43 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

73
data/helpers.d/backend
View file

@ -187,26 +187,31 @@ ynh_remove_fpm_config () {
# Create a dedicated fail2ban config (jail and filter conf files) # Create a dedicated fail2ban config (jail and filter conf files)
# #
# usage: ynh_add_fail2ban_config log_file filter [max_retry [ports]] # usage: ynh_add_fail2ban_config log_file filter [max_retry [ports]]
# | arg: log_file - Log file to be checked by fail2ban # | arg: -l, --logpath= - Log file to be checked by fail2ban
# | arg: failregex - Failregex to be looked for by fail2ban # | arg: -r, --failregex= - Failregex to be looked for by fail2ban
# | arg: max_retry - Maximum number of retries allowed before banning IP address - default: 3 # | arg: -m, --max_retry= - Maximum number of retries allowed before banning IP address - default: 3
# | arg: ports - Ports blocked for a banned IP address - default: http,https # | arg: -p, --ports= - Ports blocked for a banned IP address - default: http,https
ynh_add_fail2ban_config () { ynh_add_fail2ban_config () {
# Process parameters # Declare an array to define the options of this helper.
logpath=$1 declare -Ar args_array=( [l]=logpath= [r]=failregex= [m]=max_retry= [p]=ports= )
failregex=$2 local logpath
max_retry=${3:-3} local failregex
ports=${4:-http,https} local max_retry
local ports
test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing." # Manage arguments with getopts
test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing." ynh_handle_getopts_args "$@"
max_retry=${max_retry:-3}
ports=${ports:-http,https}
finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf" test -n "$logpath" || ynh_die "ynh_add_fail2ban_config expects a logfile path as first argument and received nothing."
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf" test -n "$failregex" || ynh_die "ynh_add_fail2ban_config expects a failure regex as second argument and received nothing."
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1
tee $finalfail2banjailconf <<EOF finalfail2banjailconf="/etc/fail2ban/jail.d/$app.conf"
finalfail2banfilterconf="/etc/fail2ban/filter.d/$app.conf"
ynh_backup_if_checksum_is_different "$finalfail2banjailconf" 1
ynh_backup_if_checksum_is_different "$finalfail2banfilterconf" 1
sudo tee $finalfail2banjailconf <<EOF
[$app] [$app]
enabled = true enabled = true
port = $ports port = $ports
@ -215,7 +220,7 @@ logpath = $logpath
maxretry = $max_retry maxretry = $max_retry
EOF EOF
sudo tee $finalfail2banfilterconf <<EOF sudo tee $finalfail2banfilterconf <<EOF
[INCLUDES] [INCLUDES]
before = common.conf before = common.conf
[Definition] [Definition]
@ -223,23 +228,31 @@ failregex = $failregex
ignoreregex = ignoreregex =
EOF EOF
ynh_store_file_checksum "$finalfail2banjailconf" ynh_store_file_checksum "$finalfail2banjailconf"
ynh_store_file_checksum "$finalfail2banfilterconf" ynh_store_file_checksum "$finalfail2banfilterconf"
systemctl reload fail2ban if [ "$(lsb_release --codename --short)" != "jessie" ]; then
local fail2ban_error="$(journalctl -u fail2ban | tail -n50 | grep "WARNING.*$app.*")" systemctl reload fail2ban
if [ -n "$fail2ban_error" ] else
then systemctl restart fail2ban
echo "[ERR] Fail2ban failed to load the jail for $app" >&2 fi
echo "WARNING${fail2ban_error#*WARNING}" >&2 local fail2ban_error="$(journalctl -u fail2ban | tail -n50 | grep "WARNING.*$app.*")"
fi if [ -n "$fail2ban_error" ]
then
echo "[ERR] Fail2ban failed to load the jail for $app" >&2
echo "WARNING${fail2ban_error#*WARNING}" >&2
fi
} }
# Remove the dedicated fail2ban config (jail and filter conf files) # Remove the dedicated fail2ban config (jail and filter conf files)
# #
# usage: ynh_remove_fail2ban_config # usage: ynh_remove_fail2ban_config
ynh_remove_fail2ban_config () { ynh_remove_fail2ban_config () {
ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf" ynh_secure_remove "/etc/fail2ban/jail.d/$app.conf"
ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf" ynh_secure_remove "/etc/fail2ban/filter.d/$app.conf"
systemctl reload fail2ban if [ "$(lsb_release --codename --short)" != "jessie" ]; then
systemctl reload fail2ban
else
systemctl restart fail2ban
fi
} }