Mercurial > repos > other > Puppet
annotate modules/fail2ban/manifests/init.pp @ 296:2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
| author | IBBoard <dev@ibboard.co.uk> |
|---|---|
| date | Sun, 09 Feb 2020 14:50:14 +0000 |
| parents | 90525117ab81 |
| children | 4f7315d7e869 |
| rev | line source |
|---|---|
| 292 | 1 class fail2ban ( |
| 2 $firewall_cmd, | |
| 3 ) { | |
| 4 package { 'fail2ban': | |
| 5 ensure => installed, | |
| 6 } | |
| 7 service { 'fail2ban': | |
| 8 ensure => running, | |
| 9 enable => true | |
| 10 } | |
| 11 File<| tag == 'fail2ban' |> { | |
| 12 ensure => present, | |
| 13 require => Package['fail2ban'], | |
| 14 notify => Service['fail2ban'], | |
| 15 } | |
| 16 file { '/etc/fail2ban/fail2ban.local': | |
| 17 source => 'puppet:///modules/fail2ban/fail2ban.local', | |
| 18 } | |
| 19 file { '/etc/fail2ban/jail.local': | |
| 20 source => 'puppet:///modules/fail2ban/jail.local', | |
| 21 } | |
| 22 file { '/etc/fail2ban/action.d/apf.conf': | |
| 23 source => 'puppet:///modules/fail2ban/apf.conf', | |
| 24 } | |
| 25 | |
| 26 if $firewall_cmd == 'iptables' { | |
| 27 $firewall_ban_cmd = 'iptables-multiport' | |
| 28 } else { | |
| 29 $firewall_ban_cmd = $firewall_cmd | |
| 30 } | |
| 31 | |
| 32 file { '/etc/fail2ban/action.d/firewall-ban.conf': | |
| 33 ensure => link, | |
| 34 target => "/etc/fail2ban/action.d/${firewall_ban_cmd}.conf", | |
| 35 } | |
| 36 file { '/etc/fail2ban/filter.d/ibb-apache-exploits-instaban.conf': | |
| 37 source => 'puppet:///modules/fail2ban/ibb-apache-exploits-instaban.conf', | |
| 38 } | |
| 39 file { '/etc/fail2ban/filter.d/ibb-apache-shellshock.conf': | |
| 40 source => 'puppet:///modules/fail2ban/ibb-apache-shellshock.conf', | |
| 41 } | |
| 42 file { '/etc/fail2ban/filter.d/ibb-repeat-offender.conf': | |
| 43 source => 'puppet:///modules/fail2ban/ibb-repeat-offender.conf', | |
| 44 } | |
| 45 file { '/etc/fail2ban/filter.d/ibb-repeat-offender-ssh.conf': | |
| 46 source => 'puppet:///modules/fail2ban/ibb-repeat-offender-ssh.conf', | |
| 47 } | |
| 48 file { '/etc/fail2ban/filter.d/ibb-postfix-spammers.conf': | |
| 49 source => 'puppet:///modules/fail2ban/ibb-postfix-spammers.conf', | |
| 50 } | |
| 51 file { '/etc/fail2ban/filter.d/ibb-postfix-malicious.conf': | |
| 52 source => 'puppet:///modules/fail2ban/ibb-postfix-malicious.conf', | |
| 53 } | |
| 54 file { '/etc/fail2ban/filter.d/ibb-postfix.conf': | |
| 55 source => 'puppet:///modules/fail2ban/ibb-postfix.conf', | |
| 56 } | |
| 57 file { '/etc/fail2ban/filter.d/ibb-sshd.conf': | |
| 58 source => 'puppet:///modules/fail2ban/ibb-sshd.conf', | |
| 59 } | |
| 60 | |
| 61 $bad_users = [ | |
| 62 '[0-9]+', | |
| 63 '[0-9a-z][0-9a-z]?', | |
| 64 '([0-9a-z])\2{2,}', | |
| 65 'abc123', | |
| 66 'abused', | |
| 67 'adm', | |
| 68 'Admin', | |
| 69 'admin[0-9]+', | |
| 70 'administrateur', | |
| 71 'administracion', | |
| 294 | 72 'admissions', |
| 292 | 73 'altibase', |
| 74 'alumni', | |
| 75 'amavisd?', | |
| 295 | 76 'amministratore', |
| 292 | 77 'anwenderschnittstelle', |
| 78 'anonymous', | |
| 79 'ansible', | |
| 80 'aptproxy', | |
| 81 'arkserver', | |
| 82 'asterisk', | |
| 83 'auser', | |
| 84 'avahi', | |
| 85 'avis', | |
| 86 'backlog', | |
| 87 'backup(s|er|pc|user)?', | |
| 88 'bf2', | |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
89 'bitcoin', |
| 292 | 90 'bitnami', |
| 91 'bitrix', | |
| 92 'boinc', | |
| 93 'botmaster', | |
| 94 'build', | |
| 95 'buscador', | |
| 96 'cacti(user)?', | |
| 97 'catchall', | |
| 98 'cemergen', | |
| 99 'chef', | |
| 100 'cinema', | |
| 101 'clamav', | |
| 102 'cliente?[0-9]*', | |
| 103 'clouduser', | |
| 104 'com', | |
| 105 'comercial', | |
| 106 'control', | |
| 107 'couchdb', | |
| 108 'cpanel', | |
| 109 'create', | |
| 110 'cron', | |
| 111 '(cs(s|go|cz)|arma|mc|tf2?|sdtd|web|pz)se?rve?r?', | |
| 112 'cyrus[0-9]*', | |
| 113 'daemon', | |
| 114 'danger', | |
| 115 'debian(-spamd)?', | |
| 116 'default', | |
| 117 'dell', | |
| 118 'deploy(er)?', | |
| 119 'desktop', | |
| 120 'developer', | |
| 121 'devops', | |
| 122 'devteam', | |
| 123 'dietpi', | |
| 124 'django', | |
| 125 'dotblot', | |
| 126 'download', | |
| 127 'dovecot', | |
| 294 | 128 'duplicity', |
| 292 | 129 'easy', |
| 130 'ec2-user', | |
| 131 'edu(cation)?[0-9]*', | |
| 132 'e-shop', | |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
133 'elsearch', |
| 292 | 134 'engin(eer)?', |
| 135 'esadmin', | |
| 136 'events', | |
| 137 'exports?', | |
| 138 'facebook', | |
| 139 'factorio', | |
| 140 'fax', | |
| 141 'filter', | |
| 142 'firebird', | |
| 143 'fuser', | |
| 144 'games', | |
| 145 'gdm', | |
| 146 'geniuz', | |
| 147 'ggc_user', | |
| 148 'ghost', | |
| 149 'git(olite?|blit|lab(_ci)?)?', | |
| 150 'gmail', | |
| 294 | 151 'gmodserver', |
| 152 'gnuhealth', | |
| 292 | 153 'gopher', |
| 154 'guest', | |
| 155 'hacker', | |
| 156 'hadoop', | |
| 157 'harvard', | |
| 158 'helpdesk', | |
| 159 'home', | |
| 160 'host', | |
| 161 'httpd?', | |
| 294 | 162 'httpfs', |
| 292 | 163 'huawei', |
| 164 'iceuser', | |
| 165 'imscp', | |
| 166 'info(rmix)?', | |
| 167 'java', | |
| 168 'jboss', | |
| 169 'jenkins', | |
| 170 'jira', | |
| 171 'jsboss', | |
| 172 'kafka', | |
| 173 'kodi', | |
| 295 | 174 'kms', |
| 292 | 175 'library', |
| 176 'libsys', | |
| 177 'libuuid', | |
| 178 'linode', | |
| 179 'linux', | |
| 295 | 180 'localadmin', |
| 292 | 181 'login', |
| 182 'logout', | |
| 295 | 183 'logstash', |
| 292 | 184 'lynx', |
| 185 'mailer', | |
| 186 'mailman', | |
| 187 'maintain', | |
| 188 'majordomo', | |
| 189 'man', | |
| 190 'mantis', | |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
191 'mapruser', |
| 292 | 192 'marketing', |
| 193 'master', | |
| 194 'membership', | |
| 195 'minecraft', | |
| 196 'modem', | |
| 197 'mongo(db|user)?', | |
| 198 'monitor', | |
| 199 'more', | |
| 200 'moher', | |
| 201 'mpiuser', | |
| 202 'musi[ck]bot', | |
| 203 '(my?|pg)sq(ue)?l', | |
| 204 'mythtv', | |
| 205 'nagios', | |
| 206 'nasa', | |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
207 'ncs', |
| 292 | 208 'netdump', |
| 209 'netzplatz', | |
| 210 'newadmin', | |
| 295 | 211 'newuser', |
| 292 | 212 'nexus', |
| 213 'nfs', | |
| 214 '(nfs)?nobody', | |
| 215 'nginx', | |
| 216 'noc', | |
| 217 'nothing', | |
| 218 'NpC', | |
| 219 'nux', | |
| 220 'odoo', | |
| 221 'odroid', | |
| 222 'onyxeye', | |
| 223 'openbravo', | |
| 294 | 224 'openfire', |
| 292 | 225 'openvpn', |
| 226 'operador', | |
| 227 'operator', | |
| 228 'ops(code)?', | |
| 229 'oprofile', | |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
230 'ora(cle|prod)[0-9]*', |
| 292 | 231 'osmc', |
| 295 | 232 'owncloud', |
| 292 | 233 'papernet', |
| 234 'password', | |
| 235 'payments', | |
| 236 'pay_?pal', | |
| 294 | 237 'pdfbox', |
| 292 | 238 'pentaho', |
| 239 'PlcmSpIp(PlcmSpIp)?', | |
| 240 'popuser', | |
| 241 'postfix', | |
| 242 'postgres', | |
| 243 'postmaster', | |
| 244 'print', | |
| 245 'privoxy', | |
| 246 'proba', | |
| 247 'proxy', | |
| 295 | 248 'public', |
| 292 | 249 'puppet', |
| 250 'qhsupport', | |
| 251 'rabbit(mq)?', | |
| 252 'radiusd?', | |
| 253 'redis', | |
| 254 'redmine', | |
| 255 'riakcs', | |
| 256 'root[0-9]+', | |
| 257 'rpc(user)?', | |
| 258 'RPM', | |
| 259 'rtorrent', | |
| 260 'rustserver', | |
| 261 'sales[0-9]+', | |
| 262 's?bin', | |
| 295 | 263 '(samba|sshd|git|student|tomcat|abc|web|info|(vpn|appl?|my|db)?(use?r|server|manager|mgr)|account)[0-9]*', |
| 292 | 264 'saslauth', |
| 265 'scaner', | |
| 266 'screen', | |
| 267 'search', | |
| 268 'setup', | |
| 294 | 269 'serverpilot', |
| 292 | 270 'service', |
| 295 | 271 '(s|u|ams|admin|inss|pro|web)?ftp(d|_?use?r|home|_?test)?[0-9]*', |
| 292 | 272 'sftponly', |
| 273 'shell', | |
| 274 'shop', | |
| 275 'sinusbot', | |
| 276 'smmsp', | |
| 277 'socket', | |
| 278 'software', | |
| 279 'solarus', | |
| 280 'splunk', | |
| 281 'squid', | |
| 282 'squirrelmail', | |
| 283 'sshusr', | |
| 284 'staffc', | |
| 285 'steam(cmd)?', | |
| 286 'store', | |
| 287 'superuser', | |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
288 'suporte', |
| 292 | 289 'support', |
| 290 'svnroot', | |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
291 'sybase', |
| 292 | 292 'sysadmin', |
| 293 'system', | |
| 294 'teamspeak3?', | |
| 295 'telkom', | |
| 296 'temp', | |
| 294 | 297 'test((er?|ing|ftp|man|use?r|u)[0-9]*|[0-9]+)?', |
| 292 | 298 '(test)?username', |
| 299 'text', | |
| 300 'tomcat', | |
| 301 'tools', | |
| 302 'toor', | |
| 303 'ts[23](se?rv(er)?|(musi[ck])?bot)?', | |
| 304 'tunstall', | |
| 305 'ubnt', | |
| 306 'ubuntu', | |
| 307 'upload', | |
| 308 'unity', | |
| 309 'USERID', | |
| 310 'user[0-9]*', | |
| 311 'usuario', | |
| 312 'uucp', | |
| 313 'vagrant', | |
| 314 'vbox', | |
| 315 'ventrilo', | |
| 316 'vhbackup', | |
| 317 'virusalter', | |
| 318 'vmadmin', | |
| 319 'vmail', | |
| 320 'vyatta', | |
| 321 'wanadoo', | |
| 322 'weblogic', | |
| 323 'webmaster', | |
| 324 'WinD3str0y', | |
| 325 'wine', | |
| 326 'wp-?user', | |
| 327 'write', | |
| 328 'www', | |
| 329 '(www|web|coin|fax|sys|db2|rsync|tc)-?(adm(in)?|run|user|data)', | |
| 330 'xbian', | |
| 331 'xbot', | |
| 332 'xoadmin', | |
| 333 'yahoo', | |
| 334 'yarn', | |
| 335 'zabbix', | |
| 336 'zimbra', | |
| 337 'zookeeper', | |
| 338 '0fordn1on@#\$%%\^&', | |
| 339 'P@\$\$w0rd', | |
| 340 'pass123?4?' | |
| 341 ] | |
| 342 | |
| 343 file { '/etc/fail2ban/filter.d/ibb-sshd-bad-user.conf': | |
| 344 content => epp('fail2ban/ibb-sshd-bad-user.epp', { 'bad_users' => $bad_users }), | |
| 345 } | |
| 346 # Because one of our rules checks fail2ban's log, but the service dies without the file | |
| 347 file { '/var/log/fail2ban.log': | |
| 348 ensure => present, | |
| 349 owner => 'root', | |
| 350 group => 'root', | |
| 351 mode => '0600', | |
| 352 } | |
| 353 } |