Skip to content

E
eterban
Commit bcdd843a authored by Ruzal Gimazov's avatar Ruzal Gimazov
Browse files
Options

Create firehol and white sets

parent 67c40fa5
Hide whitespace changes
Inline Side-by-side
Showing with 80 additions and 47 deletions
ban-server/etc/nginx/sites-enabled.d/eterban.conf
View file @ bcdd843a
server { server {
listen 91.232.225.67:80; listen 91.232.225.67:81;
#server_name priv.etersoft.ru; #server_name priv.etersoft.ru;
<------>root /var/www/html/eterban/; root /var/www/html/eterban/;
location / { location / {
<------> # add_header Access-Control-Allow-Origin *; # add_header Access-Control-Allow-Origin *;
# try_files $uri $uri/ /index.php?$query_string; # try_files $uri $uri/ /index.php?$query_string;
............
<------> index index.html; index index.html;
<------> #include /etc/nginx/fastcgi_params; #include /etc/nginx/fastcgi_params;
<------> #fastcgi_pass unix:/var/run/php7-fpm/php7.fpm.sock; #fastcgi_pass unix:/var/run/php7-fpm/php7.fpm.sock;
<------>} }
<------>location ~* \.php$ { location ~* \.php$ {
<--> #try_files $uri = 404; #try_files $uri = 404;
<--> fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_split_path_info ^(.+\.php)(/.+)$;
<--> fastcgi_pass unix:/var/run/php7-fpm/php7-fpm.sock; # подключаем сокет php-fpm fastcgi_pass unix:/var/run/php7-fpm/php7-fpm.sock; # подключаем сокет php-fpm
<--> fastcgi_index index.php; fastcgi_index index.php;
<--> fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
<--> include fastcgi_params; include fastcgi_params;
<------>} }
access_log /var/log/nginx/eterban_access.log; access_log /var/log/nginx/eterban_access.log;
error_log /var/log/nginx/eterban_error.log; error_log /var/log/nginx/eterban_error.log;
......
common/etc/eterban/settings.ini
View file @ bcdd843a
[Settings] [Settings]
#redis_server = 10.20.30.101 #redis_server = 10.20.30.101
#ban-server = 192.168.0.0 #ban_server = 192.168.0.0
#i_interface = brlocal #i_interface = brlocal
#hostname = localhost #hostname = localhost
eterban.spec
View file @ bcdd843a
...@@ -34,7 +34,7 @@ Etersoft ban service. Common files ...@@ -34,7 +34,7 @@ Etersoft ban service. Common files
%package gateway %package gateway
Summary: Etersoft ban service: gateway Summary: Etersoft ban service: gateway
Group: Development/Other Group: Development/Other
Requires: eterban-common,iptables,ipset Requires: eterban-common,iptables,ipset,conntrack-tools,python3-module-redis
%description gateway %description gateway
Etersoft ban service Etersoft ban service
...@@ -50,7 +50,7 @@ Etersoft ban service. ...@@ -50,7 +50,7 @@ Etersoft ban service.
%package fail2ban %package fail2ban
Summary: Etersoft ban service: fail2ban Summary: Etersoft ban service: fail2ban
Group: Development/Other Group: Development/Other
Requires: eterban-common,fail2ban Requires: eterban-common,fail2ban-server
%description fail2ban %description fail2ban
Etersoft ban service. Etersoft ban service.
...@@ -65,6 +65,7 @@ Etersoft ban service. ...@@ -65,6 +65,7 @@ Etersoft ban service.
#install -m644 include/limits/* %buildroot%_sysconfdir/nginx/include/limits/ #install -m644 include/limits/* %buildroot%_sysconfdir/nginx/include/limits/
mkdir -p %buildroot%_datadir/%name/ mkdir -p %buildroot%_datadir/%name/
mkdir -p %buildroot/etc/%name/ mkdir -p %buildroot/etc/%name/
mkdir -p %buildroot/etc/cron.hourly/
mkdir -p %buildroot/etc/fail2ban/action.d/ mkdir -p %buildroot/etc/fail2ban/action.d/
mkdir -p %buildroot/etc/systemd/system/ mkdir -p %buildroot/etc/systemd/system/
mkdir -p %buildroot/var/log/eterban/ mkdir -p %buildroot/var/log/eterban/
...@@ -76,6 +77,7 @@ cp -a gateway/usr/share/%name/* %buildroot%_datadir/%name/ ...@@ -76,6 +77,7 @@ cp -a gateway/usr/share/%name/* %buildroot%_datadir/%name/
install -m 644 common/etc/eterban/* %buildroot/etc/%name/ install -m 644 common/etc/eterban/* %buildroot/etc/%name/
install -m 644 gateway/etc/systemd/system/* %buildroot/etc/systemd/system/ install -m 644 gateway/etc/systemd/system/* %buildroot/etc/systemd/system/
install -m 644 gateway/etc/cron.hourly/* %buildroot/etc/cron.hourly/
install -m 644 ban-server/data/www/* %buildroot%webserver_htdocsdir/%name/ install -m 644 ban-server/data/www/* %buildroot%webserver_htdocsdir/%name/
install -m 644 ban-server/etc/nginx/sites-enabled.d/* %buildroot/etc/nginx/sites-enabled.d/ install -m 644 ban-server/etc/nginx/sites-enabled.d/* %buildroot/etc/nginx/sites-enabled.d/
...@@ -91,6 +93,7 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/ ...@@ -91,6 +93,7 @@ cp -a prod-server/usr/share/%name/* %buildroot%_datadir/%name/
%files gateway %files gateway
/etc/systemd/system/ /etc/systemd/system/
/var/log/eterban/ /var/log/eterban/
/etc/cron.hourly/
%_datadir/%name/eterban_switcher.py %_datadir/%name/eterban_switcher.py
%files web %files web
......
gateway/etc/cron.hourly/get_firehol_ip.sh 0 → 100755
View file @ bcdd843a
#!/bin/sh
firehol_name="firehol_level1"
firehol_tmp="firehol_tmp"
wget https://iplists.firehol.org/files/firehol_level1.netset -O $firehol_name
ipset create $firehol_tmp hash:net
( echo "create $firehol_tmp hash:net family inet hashsize 1024 maxelem 65536" ;\
cat $firehol_name | grep -v "^#" | sed -e "s|^\([0-9].*\)|add $firehol_tmp \1|" ) | ipset -exist restore
ipset swap $firehol_tmp $firehol_name
ipset destroy $firehol_tmp
gateway/usr/share/eterban/eterban_switcher.py
View file @ bcdd843a
...@@ -8,9 +8,11 @@ import os ...@@ -8,9 +8,11 @@ import os
import signal import signal
import socket import socket
path_to_config = '/etc/eterban/settings.ini' path_to_config = '/etc/eterban/settings.ini'
path_to_eterban = '/usr/share/eterban/' path_to_eterban = '/usr/share/eterban/'
ipset_eterban_1 = 'eterban_1' ipset_eterban_1 = 'eterban_1'
ipset_firehol = 'firehol_level1'
ipset_eterban_white = 'eterban_white'
try: try:
path_to_log = '/var/log/eterban/eterban.log' path_to_log = '/var/log/eterban/eterban.log'
...@@ -53,29 +55,44 @@ def parse_config (path_to_config, path_to_log): ...@@ -53,29 +55,44 @@ def parse_config (path_to_config, path_to_log):
return (redis_server, ban_server, i_interface) return (redis_server, ban_server, i_interface)
def save_ipset_eterban_1(): def save_ipset_eterban_1():
global ipset_eterban_1, path_to_eterban global ipset_eterban_1, ipset_firehol, ipset_eterban_white, path_to_eterban
command = 'ipset save ' + ipset_eterban_1 + ' --file ' + path_to_eterban + ipset_eterban_1 name_list = [ipset_eterban_1, ipset_firehol, ipset_eterban_white]
subprocess.call (command, shell = True) for name in name_list:
command = 'ipset save ' + name + ' --file ' + path_to_eterban + name
subprocess.call (command, shell = True)
def restore_ipset_eterban_1(path_to_eterban, ipset_eterban_1): def restore_ipset_eterban_1():
command='ipset restore --file ' + path_to_eterban + ipset_eterban_1 global ipset_eterban_1, ipset_firehol, ipset_eterban_white, path_to_eterban
subprocess.call (command, shell = True) name_list = [ipset_eterban_1, ipset_firehol, ipset_eterban_white]
for name in name_list:
command='ipset restore --file ' + path_to_eterban + name
subprocess.call (command, shell = True)
def create_iptables_rules(): def create_iptables_rules():
global ban_server, ipset_eterban_1, i_interface global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface
commands=['ipset --create ' + ipset_eterban_1 + ' iphash', commands=['ipset create ' + ipset_eterban_1 + ' iphash',
'ipset create ' + ipset_firehol + ' hash:net',
'ipset create ' + ipset_eterban_white + ' iphash',
'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server, 'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81', 'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
#'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -I PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'iptables -I FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT'] 'iptables -I FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT']
for command in commands: for command in commands:
subprocess.call (command, shell = True) subprocess.call (command, shell = True)
def destroy_iptables_rules (): def destroy_iptables_rules ():
global ban_server, ipset_eterban_1, i_interface global ban_server, ipset_eterban_1, ipset_firehol, ipset_eterban_white, i_interface
commands=['ipset destroy ' + ipset_eterban_1, commands=['iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_firehol + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server, 'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -j DNAT --to-destination ' + ban_server,
'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81', 'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_white + ' src -j ACCEPT',
'iptables -D FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT',] #'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set ! --match-set ' + ipset_eterban_1 + ' src -d ' + ban_server + ' -p tcp -m multiport --destination-port 80,443 -j DNAT --to-destination ' + ban_server + ':81',
#'iptables -t nat -D PREROUTING -i ' + i_interface + ' -m set --match-set ' + ipset_eterban_1 + ' src -p tcp --dport 443 -j DNAT --to-destination ' + ban_server + ':80',
'iptables -D FORWARD -i ' + i_interface + ' -p tcp -m multiport ! --dport 80,81,443 -m set --match-set ' + ipset_eterban_1 + ' src -j REJECT'
'ipset destroy ' + ipset_eterban_1,
'ipset destroy ' + ipset_firehol,
'ipset destroy ' + ipset_eterban_white]
for command in commands: for command in commands:
subprocess.call (command, shell = True) subprocess.call (command, shell = True)
...@@ -92,11 +109,12 @@ signal.signal(signal.SIGQUIT, exit_gracefully) ...@@ -92,11 +109,12 @@ signal.signal(signal.SIGQUIT, exit_gracefully)
signal.signal(signal.SIGTERM, exit_gracefully) signal.signal(signal.SIGTERM, exit_gracefully)
print ('1') #print ('1')
redis_server, ban_server, i_interface = parse_config (path_to_config, path_to_log) redis_server, ban_server, i_interface = parse_config (path_to_config, path_to_log)
#destroy_iptables_rules () #destroy_iptables_rules ()
print ("done!") #sys.exit()
#print ("done!")
#print (time.strftime( "%Y-%m-%d %H:%M:%S", time.localtime())) #print (time.strftime( "%Y-%m-%d %H:%M:%S", time.localtime()))
#subprocess.call ('ipset create blacklist hash:ip', stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True) #subprocess.call ('ipset create blacklist hash:ip', stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
...@@ -109,7 +127,7 @@ except: ...@@ -109,7 +127,7 @@ except:
print ("Enable to connect redes") print ("Enable to connect redes")
sys.exit() sys.exit()
restore_ipset_eterban_1(path_to_eterban, ipset_eterban_1) restore_ipset_eterban_1()
create_iptables_rules() create_iptables_rules()
...@@ -118,24 +136,23 @@ for message in p.listen(): ...@@ -118,24 +136,23 @@ for message in p.listen():
ip = message['data'].decode('utf-8') ip = message['data'].decode('utf-8')
ip = message['data'].decode('utf-8') ip = message['data'].decode('utf-8')
ban = 'ipset -A ' + ipset_eterban_1 + ' ' + ip ban = 'ipset -A ' + ipset_eterban_1 + ' ' + ip
remove = 'ipset -D ' + ipset_eterban_white + ' ' + ip
print (ban) print (ban)
print (message) print (message)
#ban = 'fail2ban-client set blacklist banip ' + ip
#subprocess.call (ban, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
subprocess.call (ban, shell = True) subprocess.call (ban, shell = True)
subprocess.call (remove, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
tcp_drop = 'conntrack -D -s ' + ip tcp_drop = 'conntrack -D -s ' + ip
subprocess.Popen(tcp_drop, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True) subprocess.Popen(tcp_drop, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
#subprocess.Popen(tcp_drop, shell = True)
elif message is not None and message['type'] =='message' and message['channel'] == b'unban' : elif message is not None and message['type'] =='message' and message['channel'] == b'unban' :
print (message) print (message)
ip = message['data'].decode('utf-8') ip = message['data'].decode('utf-8')
unban = 'ipset -D ' + ipset_eterban_1 + ' ' + ip unban = 'ipset -D ' + ipset_eterban_1 + ' ' + ip
#unban = 'fail2ban-client set blacklist unbanip ' + ip add = 'ipset -A ' + ipset_eterban_white + ' ' + ip
subprocess.call (unban, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True) subprocess.call (unban, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
#subprocess.call (unban, shell = True) subprocess.call (add, shell = True)
tcp_drop = 'conntrack -D -s ' + ip tcp_drop = 'conntrack -D -s ' + ip
subprocess.Popen(tcp_drop, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True) subprocess.Popen(tcp_drop, stdout=subprocess.PIPE, stderr=subprocess.PIPE, shell = True)
#subprocess.Popen(tcp_drop, shell = True)
elif message is not None and message['type'] =='message' and message['channel'] == b'by': elif message is not None and message['type'] =='message' and message['channel'] == b'by':
info = time.strftime( "%Y-%m-%d %H:%M:%S", time.localtime()) info = time.strftime( "%Y-%m-%d %H:%M:%S", time.localtime())
info += " " + message['data'].decode('utf-8') + "\n" info += " " + message['data'].decode('utf-8') + "\n"
...@@ -150,4 +167,4 @@ for message in p.listen(): ...@@ -150,4 +167,4 @@ for message in p.listen():
log.write(info) log.write(info)
log.flush() log.flush()
else: else:
pass pass
\ No newline at end of file
prod-server/etc/fail2ban/action.d/eterban.conf
View file @ bcdd843a
[Definition] [Definition]
actionban = /usr/share/eterban/ban.py <ip> <name> actionban = /usr/share/eterban/ban.py <ip> <name>
\ No newline at end of file \ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment