скрипт установки fail2ban ubuntu server

[Padonak]

[code]
#!/bin/bash

# ============================================
# БЫСТРАЯ НАСТРОЙКА FAIL2BAN ДЛЯ POSTFIX
# SSH bantime = 6 часов (21600 секунд)
# Почта bantime = 30 минут (1800 секунд)
# Версия: 1.2
# ============================================

set -e

echo " Установка и настройка fail2ban для Postfix..."

# 1. Установка fail2ban
apt-get update -qq
apt-get install -y fail2ban -qq

# 2. Остановка для настройки
systemctl stop fail2ban

# 3. Создание фильтров
cat > /etc/fail2ban/filter.d/postfix-sasl.conf << 'EOF'
[Definition]
failregex = ^.*warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|CRAM-MD5|DIGEST-MD5) authentication failed(: [0-9]+)?$
^.*postfix/smtpd\[[0-9]+\]: warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|CRAM-MD5|DIGEST-MD5) authentication failed(: [0-9]+)?$
^.*unknown\[<HOST>\]: SASL (?:LOGIN|PLAIN|CRAM-MD5|DIGEST-MD5) authentication failed.*$
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/postfix-pipelining.conf << 'EOF'
[Definition]
failregex = ^.*improper command pipelining after CONNECT from unknown\[<HOST>\].*$
^.*lost connection after CONNECT from unknown\[<HOST>\].*$
^.*disconnect from unknown\[<HOST>\] commands=0/0.*$
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/postfix-helo.conf << 'EOF'
[Definition]
failregex = ^.*NOQUEUE: reject: RCPT from unknown\[<HOST>\]: 554 5.7.1.*$
^.*reject: RCPT from unknown\[<HOST>\]: 554 5.7.1.*$
^.*helo command rejected from unknown\[<HOST>\].*$
^.*EHLO command rejected from unknown\[<HOST>\].*$
ignoreregex =
EOF

cat > /etc/fail2ban/filter.d/postfix-flood.conf << 'EOF'
[Definition]
failregex = ^.*connect from unknown\[<HOST>\].*$
ignoreregex =
EOF

# 4. Создание jail.local
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 1800
findtime = 600
maxretry = 3
ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
backend = polling

# ============================================
# SSH - 6 часов (21600 секунд)
# ============================================
[sshd]
enabled = true
port = ssh
logpath = /var/log/auth.log
maxretry = 3
findtime = 300
bantime = 21600
backend = polling
action = iptables-multiport[name=sshd, port=ssh, protocol=tcp]

# ============================================
# POSTFIX - 30 минут (1800 секунд)
# ============================================
[postfix-sasl]
enabled = true
filter = postfix-sasl
logpath = /var/log/mail.log
maxretry = 2
findtime = 180
bantime = 1800
backend = polling
action = iptables-multiport[name=postfix, port="smtp,465,587,25,submission", protocol=tcp]

[postfix-pipelining]
enabled = true
filter = postfix-pipelining
logpath = /var/log/mail.log
maxretry = 2
findtime = 180
bantime = 1800
backend = polling
action = iptables-multiport[name=postfix, port="smtp,465,587,25,submission", protocol=tcp]

[postfix-helo]
enabled = true
filter = postfix-helo
logpath = /var/log/mail.log
maxretry = 2
findtime = 180
bantime = 1800
backend = polling
action = iptables-multiport[name=postfix, port="smtp,465,587,25,submission", protocol=tcp]

[postfix-flood]
enabled = true
filter = postfix-flood
logpath = /var/log/mail.log
maxretry = 5
findtime = 60
bantime = 1800
backend = polling
action = iptables-multiport[name=postfix, port="smtp,465,587,25,submission", protocol=tcp]
EOF

# 5. Проверка конфигурации
fail2ban-client -t

# 6. Запуск
systemctl start fail2ban
systemctl enable fail2ban

# 7. Проверка статуса
echo ""
echo "========================================="
echo " НАСТРОЙКА ЗАВЕРШЕНА!"
echo "========================================="
echo ""
echo " Статус fail2ban:"
fail2ban-client status
echo ""
echo " SSH bantime: $(fail2ban-client get sshd bantime) секунд = $(($(fail2ban-client get sshd bantime) / 3600)) часов"
echo " Postfix bantime: $(fail2ban-client get postfix-sasl bantime) секунд = $(($(fail2ban-client get postfix-sasl bantime) / 60)) минут"
echo ""
echo "========================================="
[/code]

[b]Итог:[/b]
Сервис Время бана
[i]SSH 6 часов
Postfix 30 минут[/i]

[Padonak]

# Проверить статус
sudo fail2ban-client status

# Проверить конкретный jail
sudo fail2ban-client status postfix-sasl

# Посмотреть забаненные IP
sudo fail2ban-client get postfix-sasl banip

# Забанить IP вручную
sudo fail2ban-client set postfix-sasl banip IP

# Разбанить IP
sudo fail2ban-client set postfix-sasl unbanip IP

# Посмотреть логи
sudo tail -f /var/log/fail2ban.log