@@ -7,6 +7,11 @@ ENV DEBIAN_FRONTEND=noninteractive
|
||||
# Instalar dependencias del sistema
|
||||
RUN apt-get update && apt-get install -y \
|
||||
perl \
|
||||
libnet-cidr-lite-perl \
|
||||
libio-socket-ssl-perl \
|
||||
libwww-perl \
|
||||
libgeo-ip-perl \
|
||||
cpanminus \
|
||||
wget \
|
||||
curl \
|
||||
unzip \
|
||||
@@ -23,6 +28,9 @@ RUN apt-get update && apt-get install -y \
|
||||
dnsutils \
|
||||
&& rm -rf /var/lib/apt/lists/*
|
||||
|
||||
# Instalar módulos Perl adicionales que pueda necesitar CSF
|
||||
RUN cpanm --notest Net::CIDR::Lite IO::Socket::SSL || true
|
||||
|
||||
# Crear directorios necesarios
|
||||
RUN mkdir -p /usr/local/csf \
|
||||
&& mkdir -p /etc/csf \
|
||||
@@ -35,6 +43,18 @@ COPY scripts/csf/ /tmp/csf/
|
||||
# Instalar CSF
|
||||
RUN cd /tmp/csf && \
|
||||
cp -r * /usr/local/csf/ && \
|
||||
mkdir -p /usr/local/csf/bin && \
|
||||
mkdir -p /usr/local/csf/lib && \
|
||||
cp csf.pl /usr/local/csf/bin/csf && \
|
||||
cp lfd.pl /usr/local/csf/bin/lfd && \
|
||||
cp version.txt /usr/local/csf/ && \
|
||||
cp -r ConfigServer /usr/local/csf/lib/ && \
|
||||
cp -r Crypt /usr/local/csf/lib/ && \
|
||||
cp -r HTTP /usr/local/csf/lib/ && \
|
||||
cp -r JSON /usr/local/csf/lib/ && \
|
||||
cp -r Module /usr/local/csf/lib/ && \
|
||||
cp -r Net /usr/local/csf/lib/ && \
|
||||
cp -r version /usr/local/csf/lib/ && \
|
||||
chmod +x /usr/local/csf/bin/csf && \
|
||||
chmod +x /usr/local/csf/bin/lfd && \
|
||||
ln -sf /usr/local/csf/bin/csf /usr/local/bin/csf && \
|
||||
@@ -48,19 +68,18 @@ RUN cp /usr/local/csf/csf.conf /etc/csf/ && \
|
||||
cp /usr/local/csf/csf.pignore /etc/csf/ && \
|
||||
cp /usr/local/csf/csf.fignore /etc/csf/ && \
|
||||
cp /usr/local/csf/csf.blocklists /etc/csf/ && \
|
||||
cp /usr/local/csf/csf.logfiles /etc/csf/
|
||||
cp /usr/local/csf/csf.logfiles /etc/csf/ && \
|
||||
cp /usr/local/csf/version.txt /etc/csf/
|
||||
|
||||
# Configurar CSF para producción en contenedor
|
||||
RUN sed -i 's/TESTING = "1"/TESTING = "0"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/RESTRICT_SYSLOG = "0"/RESTRICT_SYSLOG = "3"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/AUTO_UPDATES = "1"/AUTO_UPDATES = "0"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/LF_DAEMON = "1"/LF_DAEMON = "0"/' /etc/csf/csf.conf
|
||||
|
||||
# Configurar puertos básicos
|
||||
RUN echo 'TCP_IN = "22,80,443,3000"' >> /etc/csf/csf.conf && \
|
||||
echo 'TCP_OUT = "22,25,53,80,113,443,587,993,995"' >> /etc/csf/csf.conf && \
|
||||
echo 'UDP_IN = "53"' >> /etc/csf/csf.conf && \
|
||||
echo 'UDP_OUT = "53,113,123"' >> /etc/csf/csf.conf
|
||||
sed -i 's/LF_DAEMON = "1"/LF_DAEMON = "0"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/TCP_IN = ".*"/TCP_IN = "22,80,443,3000"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/TCP_OUT = ".*"/TCP_OUT = "22,25,53,80,113,443,587,993,995"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/UDP_IN = ".*"/UDP_IN = "53"/' /etc/csf/csf.conf && \
|
||||
sed -i 's/UDP_OUT = ".*"/UDP_OUT = "53,113,123"/' /etc/csf/csf.conf
|
||||
|
||||
# Permitir acceso desde la red de Docker
|
||||
RUN echo '172.16.0.0/12 # Docker network' >> /etc/csf/csf.allow && \
|
||||
@@ -91,7 +110,7 @@ VOLUME ["/etc/csf", "/var/log/lfd", "/var/lib/csf"]
|
||||
|
||||
# Healthcheck
|
||||
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
||||
CMD /usr/local/csf/bin/csf --status > /dev/null 2>&1 || exit 1
|
||||
CMD /usr/local/bin/csf --status > /dev/null 2>&1 || exit 1
|
||||
|
||||
# Punto de entrada
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
|
||||
Referencia en una nueva incidencia
Block a user