59 lines
4.7 KiB
YAML
59 lines
4.7 KiB
YAML
apiVersion: v1
|
|
data:
|
|
nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
|
|
black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
|
|
'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
|
|
and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
|
|
by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
|
|
here as unique identifier for user):\n#\n# http {\n# ...\n# # maps to
|
|
check user is blacklisted (banned in f2b):\n# #map $arg_token_id $blck_lst_tok
|
|
{ include blacklisted-tokens.map; }\n# map $cookie_session_id $blck_lst_ses
|
|
{ include blacklisted-sessions.map; }\n# ...\n# # special log-format to
|
|
notify fail2ban about failures:\n# log_format f2b_session_errors '$msec failure
|
|
\"$cookie_session_id\" - $remote_addr - $remote_user '\n# ;# '\"$request\"
|
|
$status $bytes_sent '\n# # '\"$http_referer\" \"$http_user_agent\"';\n#\n#
|
|
\ # location checking blacklisted values:\n# location ... {\n# #
|
|
check banned sessionid:\n# if ($blck_lst_ses != \"\") {\n# try_files
|
|
\"\" @f2b-banned;\n# }\n# ...\n# # notify fail2ban about a failure
|
|
inside nginx:\n# error_page 401 = @notify-f2b;\n# ...\n# }\n#
|
|
\ ...\n# # location for return with \"403 Forbidden\" if banned:\n# location
|
|
@f2b-banned {\n# default_type text/html;\n# return 403 \"<br/><center>\n#
|
|
\ <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
|
|
\ You are banned!</b></center>\";\n# }\n# ...\n# # location
|
|
to notify fail2ban about a failure inside nginx:\n# location @notify-f2b {\n#
|
|
\ access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n# }\n#
|
|
\ }\n# ...\n#\n# Note that quote-character (and possibly other special characters)
|
|
are not allowed currently as session-id.\n# Thus please add any session-id validation
|
|
rule in your locations (or in the corresponding backend-service), \n# like in
|
|
example below:\n#\n# location ... {\n# if ($cookie_session_id !~ \"^[\\w\\-]+$\")
|
|
{\n# return 403 \"Wrong session-id\"\n# }\n# ...\n# }\n#\n# The
|
|
parameters for jail corresponding log-format (f2b_session_errors):\n#\n# [nginx-blck-lst]\n#
|
|
\ filter =\n# datepattern = ^Epoch\n# failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
|
|
- <ADDR>\n# usedns = no\n#\n# The same log-file can be used for IP-related jail
|
|
(additionally to session-related, to ban very bad IPs):\n#\n# [nginx-blck-ip]\n#
|
|
\ maxretry = 100\n# filter =\n# datepattern = ^Epoch\n# failregex = ^ failure
|
|
\"[^\"]+\" - <ADDR>\n# usedns = no\n#\n\n[Definition]\n\n# path to configuration
|
|
of nginx (used to target nginx-instance in multi-instance system,\n# and as path
|
|
for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
|
|
cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
|
|
= nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
|
|
command used to check whether nginx is running and configuration is valid:\nsrv_is_running
|
|
= [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
|
|
first test nginx is running and configuration is correct, hereafter send reload
|
|
signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n# %(srv_cmd)s
|
|
-s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n# fi;\n\nrestart_file
|
|
= /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
|
|
20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
|
|
= nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
|
|
Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
|
|
= truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
|
|
= \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
|
|
| awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
|
|
%(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
|
|
sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
|
|
kind: ConfigMap
|
|
metadata:
|
|
creationTimestamp: null
|
|
name: nginx-block-map-action
|
|
namespace: fail2ban
|