adding all missed external_manifests
This commit is contained in:
@@ -0,0 +1,58 @@
|
||||
apiVersion: v1
|
||||
data:
|
||||
nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
|
||||
black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
|
||||
'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
|
||||
and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
|
||||
by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
|
||||
here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to
|
||||
check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok
|
||||
{ include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses
|
||||
{ include blacklisted-sessions.map; }\n# ...\n# # special log-format to
|
||||
notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure
|
||||
\"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\"
|
||||
$status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n#
|
||||
\ # location checking blacklisted values:\n# location ... {\n# #
|
||||
check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files
|
||||
\"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure
|
||||
inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n#
|
||||
\ ...\n# # location for return with \"403 Forbidden\" if banned:\n# location
|
||||
@f2b-banned {\n# default_type text/html;\n# return 403 \"<br/><center>\n#
|
||||
\ <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
|
||||
\ You are banned!</b></center>\";\n# }\n# ...\n# # location
|
||||
to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n#
|
||||
\ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n#
|
||||
\ }\n# ...\n#\n# Note that quote-character (and possibly other special characters)
|
||||
are not allowed currently as session-id.\n# Thus please add any session-id validation
|
||||
rule in your locations (or in the corresponding backend-service), \n# like in
|
||||
example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\")
|
||||
{\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The
|
||||
parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n#
|
||||
\ filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
|
||||
- <ADDR>\n# usedns = no\n#\n# The same log-file can be used for IP-related jail
|
||||
(additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n#
|
||||
\ maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure
|
||||
\"[^\"]+\" - <ADDR>\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration
|
||||
of nginx (used to target nginx-instance in multi-instance system,\n# and as path
|
||||
for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
|
||||
cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
|
||||
= nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
|
||||
command used to check whether nginx is running and configuration is valid:\nsrv_is_running
|
||||
= [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
|
||||
first test nginx is running and configuration is correct, hereafter send reload
|
||||
signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s
|
||||
-s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file
|
||||
= /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
|
||||
20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
|
||||
= nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
|
||||
Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
|
||||
= truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
|
||||
= \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
|
||||
| awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
|
||||
%(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
|
||||
sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: nginx-block-map-action
|
||||
namespace: fail2ban
|
||||
Reference in New Issue
Block a user