Mercurial > repos > other > Puppet
annotate modules/fail2ban/manifests/init.pp @ 370:cd0e77678dca
Block more SSH probe usernames from recent attack
| author | IBBoard <dev@ibboard.co.uk> |
|---|---|
| date | Sat, 27 Feb 2021 18:39:46 +0000 |
| parents | 3a1b19f6a054 |
| children | df5ad1612af7 |
| rev | line source |
|---|---|
| 292 | 1 class fail2ban ( |
| 2 $firewall_cmd, | |
| 3 ) { | |
| 4 package { 'fail2ban': | |
| 5 ensure => installed, | |
| 6 } | |
| 7 service { 'fail2ban': | |
| 8 ensure => running, | |
| 9 enable => true | |
| 10 } | |
| 11 File<| tag == 'fail2ban' |> { | |
| 12 ensure => present, | |
| 13 require => Package['fail2ban'], | |
| 14 notify => Service['fail2ban'], | |
| 15 } | |
| 16 file { '/etc/fail2ban/fail2ban.local': | |
| 17 source => 'puppet:///modules/fail2ban/fail2ban.local', | |
| 18 } | |
| 19 file { '/etc/fail2ban/jail.local': | |
| 20 source => 'puppet:///modules/fail2ban/jail.local', | |
| 21 } | |
| 22 file { '/etc/fail2ban/action.d/apf.conf': | |
| 23 source => 'puppet:///modules/fail2ban/apf.conf', | |
| 24 } | |
| 25 | |
| 26 if $firewall_cmd == 'iptables' { | |
| 27 $firewall_ban_cmd = 'iptables-multiport' | |
| 28 } else { | |
| 29 $firewall_ban_cmd = $firewall_cmd | |
| 30 } | |
|
337
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
31 # Create an empty banlist file if it doesn't exist |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
32 exec { 'httxt2dbm -i /dev/null -o /etc/httpd/conf.custom/apache_banlist.db': |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
33 path => '/usr/bin', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
34 unless => 'test -f /etc/httpd/conf.custom/apache_banlist.db', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
35 before => Service['httpd'], |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
36 } |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
37 file { '/tmp/apache_banlist.txt': |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
38 ensure => present, |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
39 seltype => 'httpd_config_t', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
40 } |
|
341
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
41 # Create an empty repeat banlist file if it doesn't exist |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
42 exec { 'httxt2dbm -i /dev/null -o /etc/httpd/conf.custom/apache_repeat_banlist.db': |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
43 path => '/usr/bin', |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
44 unless => 'test -f /etc/httpd/conf.custom/apache_repeat_banlist.db', |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
45 before => Service['httpd'], |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
46 } |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
47 file { '/tmp/apache_repeat_banlist.txt': |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
48 ensure => present, |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
49 seltype => 'httpd_config_t', |
|
3a1b19f6a054
Add a "repeat offender" ban to Apache IP block
IBBoard <dev@ibboard.co.uk>
parents:
337
diff
changeset
|
50 } |
|
337
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
51 # And let the httxt2dbm process work the rest of the time |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
52 file { '/etc/selinux/apache-ip-banlist.pp': |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
53 source => 'puppet:///modules/fail2ban/apache-ip-banlist.pp', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
54 } ~> |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
55 exec { 'semodule -i /etc/selinux/apache-ip-banlist.pp': |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
56 path => '/usr/sbin', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
57 refreshonly => true, |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
58 } |
| 292 | 59 file { '/etc/fail2ban/action.d/firewall-ban.conf': |
| 60 ensure => link, | |
| 61 target => "/etc/fail2ban/action.d/${firewall_ban_cmd}.conf", | |
| 62 } | |
|
337
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
63 file { '/etc/fail2ban/action.d/ibb-apache-ip-block.conf': |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
64 source => 'puppet:///modules/fail2ban/ibb-apache-ip-block.conf', |
|
a79ad974a548
Implement fail2ban for Apache as mod_rewrite
IBBoard <dev@ibboard.co.uk>
parents:
324
diff
changeset
|
65 } |
| 292 | 66 file { '/etc/fail2ban/filter.d/ibb-apache-exploits-instaban.conf': |
| 67 source => 'puppet:///modules/fail2ban/ibb-apache-exploits-instaban.conf', | |
| 68 } | |
| 69 file { '/etc/fail2ban/filter.d/ibb-apache-shellshock.conf': | |
| 70 source => 'puppet:///modules/fail2ban/ibb-apache-shellshock.conf', | |
| 71 } | |
| 72 file { '/etc/fail2ban/filter.d/ibb-repeat-offender.conf': | |
| 73 source => 'puppet:///modules/fail2ban/ibb-repeat-offender.conf', | |
| 74 } | |
| 75 file { '/etc/fail2ban/filter.d/ibb-repeat-offender-ssh.conf': | |
| 76 source => 'puppet:///modules/fail2ban/ibb-repeat-offender-ssh.conf', | |
| 77 } | |
| 78 file { '/etc/fail2ban/filter.d/ibb-postfix-spammers.conf': | |
| 79 source => 'puppet:///modules/fail2ban/ibb-postfix-spammers.conf', | |
| 80 } | |
| 81 file { '/etc/fail2ban/filter.d/ibb-postfix-malicious.conf': | |
| 82 source => 'puppet:///modules/fail2ban/ibb-postfix-malicious.conf', | |
| 83 } | |
| 84 file { '/etc/fail2ban/filter.d/ibb-postfix.conf': | |
| 85 source => 'puppet:///modules/fail2ban/ibb-postfix.conf', | |
| 86 } | |
| 87 file { '/etc/fail2ban/filter.d/ibb-sshd.conf': | |
| 88 source => 'puppet:///modules/fail2ban/ibb-sshd.conf', | |
| 89 } | |
| 90 | |
| 91 $bad_users = [ | |
| 297 | 92 '[^0-9a-zA-Z]+', |
| 292 | 93 '[0-9]+', |
| 297 | 94 '[0-9a-zA-Z]{1,3}', |
| 292 | 95 '([0-9a-z])\2{2,}', |
| 96 'abused', | |
| 97 'Admin', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
98 'admins?[0-9]*', |
| 297 | 99 'administr[a-z]+', # administracion, administrador, administradorweb, administrator, etc |
| 294 | 100 'admissions', |
| 292 | 101 'altibase', |
| 102 'alumni', | |
| 103 'amavisd?', | |
| 295 | 104 'amministratore', |
| 292 | 105 'anwenderschnittstelle', |
| 106 'anonymous', | |
| 107 'ansible', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
108 'apache', |
| 292 | 109 'aptproxy', |
| 297 | 110 'apt-mirror', |
| 111 'ark(server)?', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
112 'asdfas', |
| 292 | 113 'asterisk', |
| 297 | 114 'audio', |
| 292 | 115 'auser', |
| 297 | 116 'autologin', |
| 292 | 117 'avahi', |
| 118 'avis', | |
| 119 'backlog', | |
| 120 'backup(s|er|pc|user)?', | |
| 297 | 121 'bash', |
|
308
edd1e3b444e7
Blacklist more users on SSH including bugzilla
IBBoard <dev@ibboard.co.uk>
parents:
305
diff
changeset
|
122 'batch', |
| 297 | 123 'beagleindex', |
| 292 | 124 'bf2', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
125 '.*bitbucket', |
|
324
b0928653dfc2
Blacklist more users, including sshd, ftpadmin and a cPanel tool
IBBoard <dev@ibboard.co.uk>
parents:
308
diff
changeset
|
126 'bind', |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
127 'bitcoin', |
| 292 | 128 'bitnami', |
| 129 'bitrix', | |
|
308
edd1e3b444e7
Blacklist more users on SSH including bugzilla
IBBoard <dev@ibboard.co.uk>
parents:
305
diff
changeset
|
130 'bkroot', |
| 297 | 131 'blog', |
| 292 | 132 'boinc', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
133 'bot', |
| 292 | 134 'botmaster', |
|
308
edd1e3b444e7
Blacklist more users on SSH including bugzilla
IBBoard <dev@ibboard.co.uk>
parents:
305
diff
changeset
|
135 'bugzilla', |
| 292 | 136 'build', |
| 137 'buscador', | |
| 138 'cacti(user)?', | |
| 297 | 139 'carrerasoft', |
| 292 | 140 'catchall', |
| 297 | 141 'celery', |
| 292 | 142 'cemergen', |
| 297 | 143 'centos', |
| 292 | 144 'chef', |
| 297 | 145 'cgi', |
| 146 'chromeuser', | |
| 292 | 147 'cinema', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
148 'cinstall', |
| 297 | 149 'cisco', |
| 292 | 150 'clamav', |
| 151 'cliente?[0-9]*', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
152 'CloudSigma', |
| 292 | 153 'clouduser', |
| 154 'com', | |
| 155 'comercial', | |
| 156 'control', | |
| 157 'couchdb', | |
| 158 'cpanel', | |
|
324
b0928653dfc2
Blacklist more users, including sshd, ftpadmin and a cPanel tool
IBBoard <dev@ibboard.co.uk>
parents:
308
diff
changeset
|
159 'cpanelrrdtool', |
| 292 | 160 'create', |
| 161 'cron', | |
| 297 | 162 '(cs(s|go|cz)|arma|mc|tf2?|sdtd|web|pz)-?se?rve?r?', |
| 163 'cs-?go1?', | |
| 164 'CumulusLinux!', | |
| 292 | 165 'cyrus[0-9]*', |
| 166 'daemon', | |
| 167 'danger', | |
| 297 | 168 'darwin', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
169 'dasuse?r[0-9]*', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
170 'data(ba?se)?', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
171 'db2inst[0-9]*', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
172 'dbus', |
| 292 | 173 'debian(-spamd)?', |
| 174 'default', | |
| 175 'dell', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
176 'demo', |
| 297 | 177 'deploy(er)?[0-9]*', |
| 292 | 178 'desktop', |
| 179 'developer', | |
| 297 | 180 'devdata', |
| 292 | 181 'devops', |
| 182 'devteam', | |
| 183 'dietpi', | |
| 297 | 184 'discordbot', |
| 185 'disklessadmin', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
186 'display', |
| 292 | 187 'django', |
| 297 | 188 'dmarc', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
189 'dpvirtual', |
| 297 | 190 'dockeruser', |
| 292 | 191 'dotblot', |
| 192 'download', | |
| 193 'dovecot', | |
| 297 | 194 'dovenull', |
| 294 | 195 'duplicity', |
| 292 | 196 'easy', |
| 197 'ec2-user', | |
| 297 | 198 'ecquser', |
| 292 | 199 'edu(cation)?[0-9]*', |
| 200 'e-shop', | |
| 297 | 201 'elastic', |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
202 'elsearch', |
| 292 | 203 'engin(eer)?', |
| 204 'esadmin', | |
| 205 'events', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
206 'exploit', |
| 292 | 207 'exports?', |
| 208 'facebook', | |
| 209 'factorio', | |
| 210 'fax', | |
| 297 | 211 'fcweb', |
| 212 'fetchmail', | |
| 292 | 213 'filter', |
| 214 'firebird', | |
| 297 | 215 'firefox', |
|
324
b0928653dfc2
Blacklist more users, including sshd, ftpadmin and a cPanel tool
IBBoard <dev@ibboard.co.uk>
parents:
308
diff
changeset
|
216 'ftp(admin)?', |
| 292 | 217 'fuser', |
| 218 'games', | |
| 219 'gdm', | |
| 220 'geniuz', | |
| 297 | 221 'getmail', |
| 292 | 222 'ggc_user', |
| 223 'ghost', | |
| 297 | 224 'git(olite?|blit|lab(_ci)?|admi?n?|use?r)?', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
225 'glassfish', |
| 292 | 226 'gmail', |
| 294 | 227 'gmodserver', |
| 228 'gnuhealth', | |
| 292 | 229 'gopher', |
| 297 | 230 'government', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
231 'grid', |
| 292 | 232 'guest', |
| 233 'hacker', | |
| 234 'hadoop', | |
| 297 | 235 'haldaemon', |
| 292 | 236 'harvard', |
| 297 | 237 'hduser', |
| 238 'headmaster', | |
| 292 | 239 'helpdesk', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
240 'hive', |
| 292 | 241 'home', |
| 242 'host', | |
| 243 'httpd?', | |
| 294 | 244 'httpfs', |
| 292 | 245 'huawei', |
| 297 | 246 'iamroot', |
| 292 | 247 'iceuser', |
| 248 'imscp', | |
| 297 | 249 'info(rmix)?[0-9]*', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
250 'inst[0-9]+', |
| 297 | 251 'installer', |
| 252 'inventario', | |
| 292 | 253 'java', |
| 254 'jboss', | |
| 255 'jenkins', | |
| 256 'jira', | |
| 297 | 257 'jmeter', |
| 292 | 258 'jsboss', |
| 297 | 259 'juniper', |
| 292 | 260 'kafka', |
| 261 'kodi', | |
| 295 | 262 'kms', |
| 297 | 263 'legacy', |
| 292 | 264 'library', |
| 265 'libsys', | |
| 266 'libuuid', | |
| 267 'linode', | |
| 268 'linux', | |
| 295 | 269 'localadmin', |
| 297 | 270 'logcheck', |
| 292 | 271 'login', |
| 272 'logout', | |
| 295 | 273 'logstash', |
| 297 | 274 'logview(er)?', |
| 275 'lsfadmin', | |
| 292 | 276 'lynx', |
| 297 | 277 'magento', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
278 'mail', |
| 292 | 279 'mailer', |
| 280 'mailman', | |
| 297 | 281 'mailtest', |
| 292 | 282 'maintain', |
| 283 'majordomo', | |
| 284 'man', | |
| 285 'mantis', | |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
286 'mapruser', |
| 292 | 287 'marketing', |
| 288 'master', | |
| 289 'membership', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
290 'merlin', |
| 297 | 291 'messagebus', |
| 292 | 292 'minecraft', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
293 'mirc', |
| 292 | 294 'modem', |
| 295 'mongo(db|user)?', | |
| 297 | 296 'monitor(ing)?', |
| 292 | 297 'more', |
| 298 'moher', | |
| 299 'mpiuser', | |
| 297 | 300 'mqadm', |
| 292 | 301 'musi[ck]bot', |
| 297 | 302 '(my?|pg)sq(ue)?l[0-9]*', |
| 292 | 303 'mythtv', |
| 304 'nagios', | |
| 297 | 305 'named', |
| 292 | 306 'nasa', |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
307 'ncs', |
| 297 | 308 'nessus', |
| 309 'netadmin', | |
| 310 'netdiag', | |
| 292 | 311 'netdump', |
| 297 | 312 'network', |
| 292 | 313 'netzplatz', |
| 314 'newadmin', | |
| 295 | 315 'newuser', |
| 292 | 316 'nexus', |
| 297 | 317 'nfinity', |
| 292 | 318 'nfs', |
| 319 '(nfs)?nobody', | |
| 320 'nginx', | |
| 321 'noc', | |
| 297 | 322 'node', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
323 'notes', |
| 292 | 324 'nothing', |
| 325 'NpC', | |
| 326 'nux', | |
| 327 'odoo', | |
| 328 'odroid', | |
| 297 | 329 'office', |
| 330 'omsagent', | |
| 292 | 331 'onyxeye', |
| 297 | 332 'oozie', |
| 292 | 333 'openbravo', |
| 294 | 334 'openfire', |
| 292 | 335 'openvpn', |
| 336 'operador', | |
| 337 'operator', | |
| 338 'ops(code)?', | |
| 339 'oprofile', | |
| 297 | 340 'ora(cle|prod|vis)[0-9]*', |
| 292 | 341 'osmc', |
| 295 | 342 'owncloud', |
| 292 | 343 'papernet', |
| 297 | 344 'passwo?r?d', |
| 292 | 345 'payments', |
| 346 'pay_?pal', | |
| 294 | 347 'pdfbox', |
| 292 | 348 'pentaho', |
| 297 | 349 'php[0-9]*', |
| 350 'platform', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
351 'play', |
| 292 | 352 'PlcmSpIp(PlcmSpIp)?', |
| 297 | 353 'plex', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
354 'polkitd?', |
| 297 | 355 'popd?3?', |
| 292 | 356 'popuser', |
| 357 'postfix', | |
| 297 | 358 'p0stgr3s', |
| 292 | 359 'postgres', |
| 360 'postmaster', | |
| 297 | 361 'pptpd', |
| 292 | 362 'print', |
| 363 'privoxy', | |
| 364 'proba', | |
| 365 'proxy', | |
| 295 | 366 'public', |
| 292 | 367 'puppet', |
| 368 'qhsupport', | |
| 369 'rabbit(mq)?', | |
| 370 'radiusd?', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
371 'raspberry', |
| 297 | 372 'readonly', |
| 373 'reboot', | |
| 374 'recording', | |
| 292 | 375 'redis', |
| 376 'redmine', | |
| 297 | 377 'remote', |
| 378 'reports', | |
| 292 | 379 'riakcs', |
| 380 'root[0-9]+', | |
| 381 'rpc(user)?', | |
| 297 | 382 'rpm', |
| 292 | 383 'RPM', |
| 384 'rtorrent', | |
| 385 'rustserver', | |
| 386 'sales[0-9]+', | |
| 387 's?bin', | |
| 388 'saslauth', | |
| 297 | 389 'scan(n?er)?', |
| 292 | 390 'screen', |
| 391 'search', | |
| 297 | 392 'sekretariat', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
393 'server', |
| 294 | 394 'serverpilot', |
| 292 | 395 'service', |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
396 'setup', |
| 297 | 397 '(s|u|ams|admin|inss|pro|web)?ftp(d|[_-]?use?r|home|_?test|immo)?[0-9]*', |
| 292 | 398 'sftponly', |
| 399 'shell', | |
| 400 'shop', | |
| 297 | 401 'sinusbot[0-9]*', |
|
324
b0928653dfc2
Blacklist more users, including sshd, ftpadmin and a cPanel tool
IBBoard <dev@ibboard.co.uk>
parents:
308
diff
changeset
|
402 'sirius', |
| 297 | 403 'smbguest', |
| 404 'smbuse?r', | |
| 292 | 405 'smmsp', |
| 406 'socket', | |
| 407 'software', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
408 'solr', |
| 292 | 409 'solarus', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
410 'spam', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
411 'spark', |
|
308
edd1e3b444e7
Blacklist more users on SSH including bugzilla
IBBoard <dev@ibboard.co.uk>
parents:
305
diff
changeset
|
412 'speech-dispatcher', |
| 292 | 413 'splunk', |
| 297 | 414 'sprummlbot', |
| 292 | 415 'squid', |
| 297 | 416 'squirrelmail[0-9]+', |
| 417 'srvadmin', | |
|
324
b0928653dfc2
Blacklist more users, including sshd, ftpadmin and a cPanel tool
IBBoard <dev@ibboard.co.uk>
parents:
308
diff
changeset
|
418 'sshd', |
| 292 | 419 'sshusr', |
| 420 'staffc', | |
| 421 'steam(cmd)?', | |
| 422 'store', | |
| 297 | 423 'stunnel', |
| 292 | 424 'superuser', |
|
296
2f4d0ea4cb55
Blacklist Portuguese support, MapR, numbered Oracle and more
IBBoard <dev@ibboard.co.uk>
parents:
295
diff
changeset
|
425 'suporte', |
| 292 | 426 'support', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
427 'svn(root|admin)?', |
|
293
55762b436f89
Add more blacklisted SSH usernames
IBBoard <dev@ibboard.co.uk>
parents:
292
diff
changeset
|
428 'sybase', |
| 297 | 429 'sync[0-9]*', |
| 292 | 430 'sysadmin', |
| 431 'system', | |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
432 'teamspeak[234]?(-?use?r)?', |
| 292 | 433 'telkom', |
| 297 | 434 'telnetd?', |
| 435 'te?mp(use?r)?[0-9]*', | |
|
305
38e35360a390
Blacklist hive, polkitd, cinstall and more as SSH logins
IBBoard <dev@ibboard.co.uk>
parents:
297
diff
changeset
|
436 'test((er?|ing|ftp|man|linux|use?r|u)[0-9]*|[0-9]+)?', |
| 292 | 437 '(test)?username', |
| 438 'text', | |
| 439 'tomcat', | |
| 440 'tools', | |
| 441 'toor', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
442 'ts[123](se?rv(er)?|(musi[ck])?bot|sleep|user)?', |
| 297 | 443 'tss', |
| 292 | 444 'tunstall', |
| 445 'ubnt', | |
| 446 'unity', | |
| 297 | 447 'universitaetsrechenzentrum', # University Computing Center |
| 448 'upload[0-9]*', | |
| 449 'user[0-9]*', | |
| 292 | 450 'USERID', |
| 297 | 451 'username', |
| 292 | 452 'usuario', |
| 453 'uucp', | |
| 454 'vagrant', | |
| 455 'vbox', | |
| 456 'ventrilo', | |
| 457 'vhbackup', | |
| 458 'virusalter', | |
| 459 'vmadmin', | |
| 460 'vmail', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
461 'vscan?', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
462 'vtms', |
| 292 | 463 'vyatta', |
| 464 'wanadoo', | |
|
308
edd1e3b444e7
Blacklist more users on SSH including bugzilla
IBBoard <dev@ibboard.co.uk>
parents:
305
diff
changeset
|
465 'web', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
466 'webapp', |
| 292 | 467 'weblogic', |
| 468 'webmaster', | |
| 297 | 469 'webportal', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
470 'websync', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
471 'wiki', |
| 292 | 472 'WinD3str0y', |
| 473 'wine', | |
| 297 | 474 'wordpress', |
| 292 | 475 'wp-?user', |
| 476 'write', | |
| 477 'www', | |
| 297 | 478 'wwAdmin', |
| 479 '(www|web|coin|fax|sys|db2|rsync|tc)-?(adm(in)?|run|users?|data|[0-9]+)', | |
| 292 | 480 'xbian', |
| 481 'xbot', | |
| 297 | 482 'xmpp', |
| 292 | 483 'xoadmin', |
| 484 'yahoo', | |
| 485 'yarn', | |
| 486 'zabbix', | |
| 487 'zimbra', | |
| 488 'zookeeper', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
489 # User/admin/other |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
490 '(api|appl?|ats|cam|cat|db|imap|is|my|virtual|vpn)?(admin|dev|use?r|server|man|manager|mgr)[0-9]*', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
491 '(abc|account|git|info|redhat|samba|sshd|student|tomcat|ubuntu|web)[0-9]*', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
492 # Names |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
493 '(aaron|david|james|tom|victor)[0-9]*', |
| 297 | 494 # And some passwords that turned up as usernames |
| 495 '1q2w3e4r', | |
| 496 'abc123', | |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
497 'letmein', |
| 292 | 498 '0fordn1on@#\$%%\^&', |
| 499 'P@\$\$w0rd', | |
| 297 | 500 'P@ssword1!', |
|
370
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
501 'Pa\$\$word_', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
502 'Passwd123(\$%%\^)', |
|
cd0e77678dca
Block more SSH probe usernames from recent attack
IBBoard <dev@ibboard.co.uk>
parents:
341
diff
changeset
|
503 'password', |
| 297 | 504 'pass123?4?', |
| 505 'qwer?[0-9]+', | |
| 292 | 506 ] |
| 507 | |
| 508 file { '/etc/fail2ban/filter.d/ibb-sshd-bad-user.conf': | |
| 509 content => epp('fail2ban/ibb-sshd-bad-user.epp', { 'bad_users' => $bad_users }), | |
| 510 } | |
| 511 # Because one of our rules checks fail2ban's log, but the service dies without the file | |
| 512 file { '/var/log/fail2ban.log': | |
| 513 ensure => present, | |
| 514 owner => 'root', | |
| 515 group => 'root', | |
| 516 mode => '0600', | |
| 517 } | |
| 518 } |