External/du_setup
1
0
Fork 0
mirror of https://github.com/buildplan/du_setup.git synced 2025-12-29 16:14:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update setup_harden_debian_ubuntu.sh

Browse Source
This commit is contained in:
buildplan
2025-06-26 22:10:35 +01:00
committed by GitHub
parent 316d3804f7
commit 72a191863c
1 changed files with 8 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
setup_harden_debian_ubuntu.sh
View File

@@ -742,16 +742,10 @@ configure_firewall() {
configure_fail2ban() { configure_fail2ban() {
print_section "Fail2Ban Configuration" print_section "Fail2Ban Configuration"
# Collect all SSH ports (main SSH_PORT and any custom ports that are SSH-related)
SSH_PORTS="$SSH_PORT" # Set the SSH port for Fail2Ban to monitor.
if [[ -n "${CUSTOM_PORTS:-}" ]]; then local SSH_PORTS_TO_MONITOR="$SSH_PORT"
for port in $CUSTOM_PORTS; do
port_num="${port%%/*}"
if [[ "$port_num" != "$SSH_PORT" && "$port" =~ ^[0-9]+(/tcp)?$ ]]; then
SSH_PORTS="$SSH_PORTS,$port_num"
fi
done
fi
NEW_FAIL2BAN_CONFIG=$(mktemp) NEW_FAIL2BAN_CONFIG=$(mktemp)
tee "$NEW_FAIL2BAN_CONFIG" > /dev/null <<EOF tee "$NEW_FAIL2BAN_CONFIG" > /dev/null <<EOF
[DEFAULT] [DEFAULT]
@@ -761,7 +755,7 @@ maxretry = 3
backend = auto backend = auto
[sshd] [sshd]
enabled = true enabled = true
port = $SSH_PORTS port = $SSH_PORTS_TO_MONITOR
logpath = %(sshd_log)s logpath = %(sshd_log)s
backend = %(sshd_backend)s backend = %(sshd_backend)s
EOF EOF
@@ -769,8 +763,8 @@ EOF
print_info "Fail2Ban configuration already correct. Skipping." print_info "Fail2Ban configuration already correct. Skipping."
rm -f "$NEW_FAIL2BAN_CONFIG" rm -f "$NEW_FAIL2BAN_CONFIG"
elif [[ -f /etc/fail2ban/jail.local ]] && grep -q "\[sshd\]" /etc/fail2ban/jail.local; then elif [[ -f /etc/fail2ban/jail.local ]] && grep -q "\[sshd\]" /etc/fail2ban/jail.local; then
print_info "Fail2Ban jail.local exists. Updating SSH ports..." print_info "Fail2Ban jail.local exists. Updating SSH port..."
sed -i "s/^\(port\s*=\s*\).*/\1$SSH_PORTS/" /etc/fail2ban/jail.local sed -i "s/^\(port\s*=\s*\).*/\1$SSH_PORTS_TO_MONITOR/" /etc/fail2ban/jail.local
rm -f "$NEW_FAIL2BAN_CONFIG" rm -f "$NEW_FAIL2BAN_CONFIG"
else else
print_info "Creating Fail2Ban local jail configuration..." print_info "Creating Fail2Ban local jail configuration..."
@@ -782,7 +776,7 @@ EOF
systemctl restart fail2ban systemctl restart fail2ban
sleep 2 sleep 2
if systemctl is-active --quiet fail2ban; then if systemctl is-active --quiet fail2ban; then
print_success "Fail2Ban is active and monitoring port(s) $SSH_PORTS." print_success "Fail2Ban is active and monitoring port(s) $SSH_PORTS_TO_MONITOR."
fail2ban-client status sshd | tee -a "$LOG_FILE" fail2ban-client status sshd | tee -a "$LOG_FILE"
else else
print_error "Fail2Ban service failed to start." print_error "Fail2Ban service failed to start."