ecss
d72aa7a261
Default profile bans 3 failures in 10 minutes for 24 hours, with repeat offenders (3 bans in a day) banned for a week. The sshd jail reads the journal, the recidive jail reads fail2ban's own log file. The recidive jail can only count bans in a file, so the script resolves the effective logtarget from fail2ban.conf, fail2ban.d/*.conf and fail2ban.local, refuses a non-file target, and verifies the file really receives output before reporting success.
51 lines
2.0 KiB
Markdown
51 lines
2.0 KiB
Markdown
# Shell Scripts
|
|
|
|
> **Tip:** Install Docker Engine on Debian/Ubuntu.
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/install-docker.sh | sudo bash
|
|
```
|
|
|
|
> **Tip:** Configure registry mirrors for Docker and restart the daemon.
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/set-docker-mirror.sh | sudo bash
|
|
```
|
|
|
|
> **Tip:** Install Caddy web server on Debian/Ubuntu/Raspbian.
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/install-caddy.sh | sudo bash
|
|
```
|
|
|
|
> **Tip:** Append 2-space indent settings to `~/.vimrc`.
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/set-vim-2space.sh | bash
|
|
```
|
|
|
|
> **Tip:** Set up fail2ban with a strict profile (3 failures -> 24h ban, repeat offenders -> 1 week).
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/setup-fail2ban.sh | sudo bash
|
|
```
|
|
|
|
Override the detected SSH port, the sshd filter mode (`normal` by default: `aggressive`
|
|
also counts pre-auth client disconnects as failures, which bans legitimate users) or
|
|
whitelist an extra address:
|
|
|
|
```bash
|
|
curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/setup-fail2ban.sh | sudo SSH_PORT=22,2222 IGNORE_IP=198.51.100.0/24 bash
|
|
```
|
|
|
|
> **Note:** the script whitelists the address of the current session when it can detect it
|
|
> (`SSH_CONNECTION`, `SSH_CLIENT`, or the utmp entry of its terminal). Piped through
|
|
> `curl ... | sudo bash` there is no terminal, so it prints a warning and you should pass
|
|
> `IGNORE_IP=<your address>` yourself — otherwise 3 failed attempts ban you for 24h
|
|
> (and 3 bans for a week).
|
|
|
|
> **Note:** the script refuses to continue when fail2ban's `logtarget` is not a file
|
|
> (`SYSLOG`, `STDERR`, ...), because the `recidive` jail reads that file to count bans
|
|
> and could otherwise never fire. Set `logtarget = /var/log/fail2ban.log` in
|
|
> `/etc/fail2ban/fail2ban.local` and re-run.
|