*Drive*- Здесь рулят padonki

Код: Выделить всё

#!/bin/bash

# ============================================================
#   Fail2Ban Ultimate Installer v3.0
#   ----------------------------------------------------------
#   - loglevel: NOTICE (баны/разбаны пишутся, мусора нет)
#   - backend: systemd + journalmatch для всех тюрем
#   - 8 jail:
#       sshd, postfix-sasl, postfix-pipelining, postfix-flood,
#       postfix-helo, postfix-aggressive, dovecot-aggressive,
#       recidive (бан повторных нарушителей на 30 дней)
#   - action: iptables-ipset-proto6 (надёжно, быстро, без ошибок)
#   - Сохранение правил через ipset-persistent + iptables-persistent
# ============================================================

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo -e "${GREEN}=========================================${NC}"
echo -e "${GREEN}   Fail2Ban Ultimate Installer v3.0     ${NC}"
echo -e "${GREEN}=========================================${NC}"

# --- 1. Установка пакетов ---
echo -e "${YELLOW}[1/10] Установка пакетов...${NC}"
sudo apt update -qq
sudo DEBIAN_FRONTEND=noninteractive apt install -y \
    fail2ban \
    ipset \
    iptables-persistent \
    ipset-persistent

# --- 2. Остановка службы ---
echo -e "${YELLOW}[2/10] Остановка Fail2Ban...${NC}"
sudo systemctl stop fail2ban || true

# --- 3. fail2ban.local (уровень логирования) ---
echo -e "${YELLOW}[3/10] Создание /etc/fail2ban/fail2ban.local...${NC}"
sudo tee /etc/fail2ban/fail2ban.local > /dev/null << 'EOF'
[Definition]
loglevel = NOTICE
logtarget = /var/log/fail2ban.log
EOF

# --- 4. jail.local (все тюрьмы) ---
echo -e "${YELLOW}[4/10] Создание /etc/fail2ban/jail.local...${NC}"
sudo tee /etc/fail2ban/jail.local > /dev/null << 'EOF'
[DEFAULT]
bantime = 86400
findtime = 600
maxretry = 3
ignoreip = 127.0.0.1/8
backend = systemd

# =========================================================
# SSH
# =========================================================
[sshd]
enabled = true
port = ssh
backend = systemd
journalmatch = _SYSTEMD_UNIT=sshd.service + _COMM=sshd
maxretry = 3
findtime = 300
bantime = 3600
action = iptables-ipset-proto6[name=sshd, port=ssh, blocktype=REJECT]

# =========================================================
# POSTFIX-SASL — атаки на SASL-аутентификацию
# =========================================================
[postfix-sasl]
enabled = true
filter = postfix-sasl
backend = systemd
journalmatch = _SYSTEMD_UNIT=postfix.service
maxretry = 2
findtime = 180
bantime = 86400
maxlines = 1000
action = iptables-ipset-proto6[name=postfix, port="smtp,465,587,25,submission,imap,imaps,pop3,pop3s", blocktype=REJECT]

# =========================================================
# POSTFIX-PIPELINING — SMTP-конвейеризация
# =========================================================
[postfix-pipelining]
enabled = true
filter = postfix-pipelining
backend = systemd
journalmatch = _SYSTEMD_UNIT=postfix.service
maxretry = 3
findtime = 300
bantime = 86400
action = iptables-ipset-proto6[name=postfix, port="smtp,465,587,25,submission,imap,imaps,pop3,pop3s", blocktype=REJECT]

# =========================================================
# POSTFIX-FLOOD — флуд (много писем за раз)
# =========================================================
[postfix-flood]
enabled = true
filter = postfix-flood
backend = systemd
journalmatch = _SYSTEMD_UNIT=postfix.service
maxretry = 5
findtime = 60
bantime = 3600
action = iptables-ipset-proto6[name=postfix, port="smtp,465,587,25,submission,imap,imaps,pop3,pop3s", blocktype=REJECT]

# =========================================================
# POSTFIX-HELO — подозрительные HELO/EHLO
# =========================================================
[postfix-helo]
enabled = true
filter = postfix-helo
backend = systemd
journalmatch = _SYSTEMD_UNIT=postfix.service
maxretry = 3
findtime = 300
bantime = 86400
action = iptables-ipset-proto6[name=postfix, port="smtp,465,587,25,submission,imap,imaps,pop3,pop3s", blocktype=REJECT]

# =========================================================
# POSTFIX-AGGRESSIVE — агрессивный бан (1 неделя)
# =========================================================
[postfix-aggressive]
enabled = true
filter = postfix-sasl
backend = systemd
journalmatch = _SYSTEMD_UNIT=postfix.service
maxretry = 2
findtime = 120
bantime = 604800
action = iptables-ipset-proto6[name=postfix, port="smtp,465,587,25,submission,imap,imaps,pop3,pop3s", blocktype=REJECT]

# =========================================================
# DOVECOT-AGGRESSIVE — агрессивный бан Dovecot
# =========================================================
[dovecot-aggressive]
enabled = true
filter = dovecot
backend = systemd
journalmatch = _SYSTEMD_UNIT=dovecot.service
maxretry = 2
findtime = 120
bantime = 604800
action = iptables-ipset-proto6[name=dovecot, port="imap,imaps,pop3,pop3s,587,465", blocktype=REJECT]

# =========================================================
# RECIDIVE — бан повторных нарушителей на 30 дней
# =========================================================
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban.log
action = iptables-ipset-proto6-allports[name=recidive, blocktype=REJECT]
bantime = 2592000
findtime = 86400
maxretry = 3
backend = auto
EOF

# --- 5. Фильтры для Postfix ---
echo -e "${YELLOW}[5/10] Создание фильтров postfix...${NC}"

sudo tee /etc/fail2ban/filter.d/postfix-pipelining.conf > /dev/null << 'EOF'
[Definition]
failregex = ^<HOST>.* lost connection after (AUTH|UNKNOWN|EHLO|HELO|MAIL|RCPT|DATA|RSET|NOOP|QUIT)
            ^<HOST>.* improper command pipelining after (EHLO|HELO)
ignoreregex =
EOF

sudo tee /etc/fail2ban/filter.d/postfix-flood.conf > /dev/null << 'EOF'
[Definition]
failregex = ^<HOST>.* (too many errors after|flood|limit exceeded)
ignoreregex =
EOF

sudo tee /etc/fail2ban/filter.d/postfix-helo.conf > /dev/null << 'EOF'
[Definition]
failregex = ^<HOST>.* (HELO|EHLO) (localhost|127\.0\.0\.1)
ignoreregex =
EOF

# --- 6. Удаление старых цепочек iptables и ipset ---
echo -e "${YELLOW}[6/10] Очистка старых цепочек и наборов...${NC}"

# Цепочки sshd
sudo iptables -D INPUT -p tcp --dport 22 -j f2b-sshd 2>/dev/null || true
sudo iptables -F f2b-sshd 2>/dev/null || true
sudo iptables -X f2b-sshd 2>/dev/null || true

# Цепочки postfix
sudo iptables -D INPUT -p tcp -m multiport --dports smtp,465,587,25,submission,imap,imaps,pop3,pop3s -j f2b-postfix 2>/dev/null || true
sudo iptables -F f2b-postfix 2>/dev/null || true
sudo iptables -X f2b-postfix 2>/dev/null || true

# Цепочки dovecot
sudo iptables -D INPUT -p tcp -m multiport --dports imap,imaps,pop3,pop3s,587,465 -j f2b-dovecot 2>/dev/null || true
sudo iptables -F f2b-dovecot 2>/dev/null || true
sudo iptables -X f2b-dovecot 2>/dev/null || true

# Цепочки recidive
sudo iptables -D INPUT -j f2b-recidive 2>/dev/null || true
sudo iptables -F f2b-recidive 2>/dev/null || true
sudo iptables -X f2b-recidive 2>/dev/null || true

# Старые ipset-наборы Fail2Ban (НЕ удаляем чужие, например ssh_ban)
sudo ipset destroy f2b-sshd 2>/dev/null || true
sudo ipset destroy f2b-postfix 2>/dev/null || true
sudo ipset destroy f2b-dovecot 2>/dev/null || true
sudo ipset destroy f2b-recidive 2>/dev/null || true

# --- 7. Очистка БД Fail2Ban ---
echo -e "${YELLOW}[7/10] Очистка БД Fail2Ban...${NC}"
sudo rm -f /var/lib/fail2ban/fail2ban.sqlite3

# --- 8. Проверка синтаксиса ---
echo -e "${YELLOW}[8/10] Проверка синтаксиса...${NC}"
sudo fail2ban-client -t

# --- 9. Запуск Fail2Ban ---
echo -e "${YELLOW}[9/10] Запуск Fail2Ban...${NC}"
sudo systemctl start fail2ban
sudo systemctl enable fail2ban

# --- 10. Сохранение правил iptables/ipset ---
echo -e "${YELLOW}[10/10] Сохранение правил...${NC}"
sudo mkdir -p /etc/iptables
sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6 > /dev/null
sudo ipset save > /etc/ipset.conf 2>/dev/null || true

# Служба для восстановления ipset при загрузке
sudo tee /etc/systemd/system/ipset-restore.service > /dev/null << 'EOF'
[Unit]
Description=Restore ipset rules
Before=network-pre.target
Wants=network-pre.target

[Service]
Type=oneshot
ExecStart=/sbin/ipset restore -exist -f /etc/ipset.conf

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable ipset-restore.service 2>/dev/null || true

# --- Финальный отчёт ---
echo -e "${GREEN}=========================================${NC}"
echo -e "${GREEN}   УСТАНОВКА ЗАВЕРШЕНА!                 ${NC}"
echo -e "${GREEN}=========================================${NC}"

echo ""
echo -e "Уровень логирования: ${GREEN}$(sudo fail2ban-client get loglevel)${NC}"
echo -e "Статус службы: ${GREEN}$(systemctl is-active fail2ban)${NC}"
echo ""
echo -e "${GREEN}Активные тюрьмы:${NC}"
sudo fail2ban-client status

echo ""
echo -e "${YELLOW}Проверить баны:${NC}"
echo "  sudo ipset list f2b-sshd"
echo "  sudo ipset list f2b-postfix"
echo "  sudo ipset list f2b-recidive"
echo ""
echo -e "${YELLOW}Смотреть логи:${NC}"
echo "  sudo tail -f /var/log/fail2ban.log"
echo ""
echo -e "${YELLOW}Проверить ошибки:${NC}"
echo "  sudo tail -50 /var/log/fail2ban.log | grep ERROR"
echo ""
echo -e "${GREEN}Готово! 🚀${NC}"

Код: Выделить всё

vim  install_fail2ban.sh

Код: Выделить всё

chmod +x install_fail2ban.sh

Код: Выделить всё

sudo ./install_fail2ban.sh

Код: Выделить всё

sudo fail2ban-client status
sudo fail2ban-client get loglevel

Код: Выделить всё

 tail -30 /var/log/fail2ban.log | grep ERROR

Код: Выделить всё

 fail2ban-client set sshd banip 203.0.113.100
 ipset list f2b-sshd
 fail2ban-client set sshd unbanip 203.0.113.100

Код: Выделить всё

sudo fail2ban-client status

Код: Выделить всё

sudo fail2ban-client status postfix-sasl

Код: Выделить всё

sudo fail2ban-client get postfix-sasl banip

Код: Выделить всё

sudo fail2ban-client set postfix-sasl banip IP

Код: Выделить всё

sudo fail2ban-client set postfix-sasl unbanip IP

Код: Выделить всё

sudo tail -f /var/log/fail2ban.log