boban
/
mailwolt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix: Fail2Ban Sudoers + Jails automatisch via ensure_system einrichten

main v1.1.415
boban 2026-04-27 03:53:29 +02:00
parent 41de455826
commit f266228fcf
1 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
scripts/update.sh
View File

@ -282,6 +282,64 @@ UNIT
systemctl stop clamav-daemon 2>/dev/null || true systemctl stop clamav-daemon 2>/dev/null || true
echo "[✓] ClamAV installiert (deaktiviert – User kann es einschalten)." echo "[✓] ClamAV installiert (deaktiviert – User kann es einschalten)."
fi fi
# Fail2Ban: Jails + Sudoers sicherstellen (idempotent)
local F2B_SUDO="/etc/sudoers.d/mailwolt-fail2ban"
local F2B_JAIL="/etc/fail2ban/jail.d/mailwolt-jails.local"
if command -v fail2ban-client >/dev/null 2>&1; then
# Sudoers für www-data
if [[ ! -f "$F2B_SUDO" ]]; then
cat > "$F2B_SUDO" << 'SUDOEOF'
www-data ALL=(root) NOPASSWD: /usr/bin/tee /etc/fail2ban/jail.d/00-defaults.local
www-data ALL=(root) NOPASSWD: /usr/bin/tee /etc/fail2ban/jail.d/whitelist.local
www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client reload
www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status
www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status *
www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set * banip *
www-data ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set * unbanip *
SUDOEOF
chmod 440 "$F2B_SUDO"
echo "[✓] Fail2Ban sudoers installiert."
fi
# Jail-Konfiguration (dovecot, postfix, nginx)
if [[ ! -f "$F2B_JAIL" ]]; then
cat > "$F2B_JAIL" << 'JAILEOF'
[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps,submission,submissions,sieve
filter = dovecot
logpath = /var/log/mail.log
maxretry = 5
[postfix]
enabled = true
port = smtp,465,submission,submissions
filter = postfix[mode=more]
logpath = /var/log/mail.log
maxretry = 5
[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
/var/log/nginx/mailwolt_error.log
/var/log/nginx/mailwolt_ssl_error.log
maxretry = 5
[nginx-botsearch]
enabled = true
port = http,https
filter = nginx-botsearch
logpath = /var/log/nginx/access.log
/var/log/nginx/mailwolt_access.log
/var/log/nginx/mailwolt_ssl_access.log
maxretry = 2
JAILEOF
systemctl is-active --quiet fail2ban && fail2ban-client reload >/dev/null 2>&1 || true
echo "[✓] Fail2Ban Jails installiert (dovecot, postfix, nginx)."
fi
fi
} }
# -------- Guards -------------------------------------------------------------- # -------- Guards --------------------------------------------------------------