117 líneas
3.8 KiB
Docker
117 líneas
3.8 KiB
Docker
# Dockerfile para CSF (ConfigServer Security & Firewall)
|
|
FROM ubuntu:22.04
|
|
|
|
# Evitar prompts interactivos durante la instalación
|
|
ENV DEBIAN_FRONTEND=noninteractive
|
|
|
|
# Instalar dependencias del sistema
|
|
RUN apt-get update && apt-get install -y \
|
|
perl \
|
|
libnet-cidr-lite-perl \
|
|
libio-socket-ssl-perl \
|
|
libwww-perl \
|
|
libgeo-ip-perl \
|
|
cpanminus \
|
|
wget \
|
|
curl \
|
|
unzip \
|
|
iptables \
|
|
ipset \
|
|
fail2ban \
|
|
logrotate \
|
|
rsyslog \
|
|
cron \
|
|
nano \
|
|
net-tools \
|
|
procps \
|
|
iproute2 \
|
|
dnsutils \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Instalar módulos Perl adicionales que pueda necesitar CSF
|
|
RUN cpanm --notest Net::CIDR::Lite IO::Socket::SSL || true
|
|
|
|
# Crear directorios necesarios
|
|
RUN mkdir -p /usr/local/csf \
|
|
&& mkdir -p /etc/csf \
|
|
&& mkdir -p /var/lib/csf \
|
|
&& mkdir -p /var/log/lfd
|
|
|
|
# Copiar archivos CSF desde el directorio local
|
|
COPY scripts/csf/ /tmp/csf/
|
|
|
|
# Instalar CSF
|
|
RUN cd /tmp/csf && \
|
|
cp -r * /usr/local/csf/ && \
|
|
mkdir -p /usr/local/csf/bin && \
|
|
mkdir -p /usr/local/csf/lib && \
|
|
cp csf.pl /usr/local/csf/bin/csf && \
|
|
cp lfd.pl /usr/local/csf/bin/lfd && \
|
|
cp version.txt /usr/local/csf/ && \
|
|
cp -r ConfigServer /usr/local/csf/lib/ && \
|
|
cp -r Crypt /usr/local/csf/lib/ && \
|
|
cp -r HTTP /usr/local/csf/lib/ && \
|
|
cp -r JSON /usr/local/csf/lib/ && \
|
|
cp -r Module /usr/local/csf/lib/ && \
|
|
cp -r Net /usr/local/csf/lib/ && \
|
|
cp -r version /usr/local/csf/lib/ && \
|
|
chmod +x /usr/local/csf/bin/csf && \
|
|
chmod +x /usr/local/csf/bin/lfd && \
|
|
ln -sf /usr/local/csf/bin/csf /usr/local/bin/csf && \
|
|
ln -sf /usr/local/csf/bin/lfd /usr/local/bin/lfd
|
|
|
|
# Copiar archivos de configuración
|
|
RUN cp /usr/local/csf/csf.conf /etc/csf/ && \
|
|
cp /usr/local/csf/csf.allow /etc/csf/ && \
|
|
cp /usr/local/csf/csf.deny /etc/csf/ && \
|
|
cp /usr/local/csf/csf.ignore /etc/csf/ && \
|
|
cp /usr/local/csf/csf.pignore /etc/csf/ && \
|
|
cp /usr/local/csf/csf.fignore /etc/csf/ && \
|
|
cp /usr/local/csf/csf.blocklists /etc/csf/ && \
|
|
cp /usr/local/csf/csf.logfiles /etc/csf/ && \
|
|
cp /usr/local/csf/version.txt /etc/csf/
|
|
|
|
# Configurar CSF para producción en contenedor
|
|
RUN sed -i 's/TESTING = "1"/TESTING = "0"/' /etc/csf/csf.conf && \
|
|
sed -i 's/RESTRICT_SYSLOG = "0"/RESTRICT_SYSLOG = "3"/' /etc/csf/csf.conf && \
|
|
sed -i 's/AUTO_UPDATES = "1"/AUTO_UPDATES = "0"/' /etc/csf/csf.conf && \
|
|
sed -i 's/LF_DAEMON = "1"/LF_DAEMON = "0"/' /etc/csf/csf.conf && \
|
|
sed -i 's/TCP_IN = ".*"/TCP_IN = "22,80,443,3000"/' /etc/csf/csf.conf && \
|
|
sed -i 's/TCP_OUT = ".*"/TCP_OUT = "22,25,53,80,113,443,587,993,995"/' /etc/csf/csf.conf && \
|
|
sed -i 's/UDP_IN = ".*"/UDP_IN = "53"/' /etc/csf/csf.conf && \
|
|
sed -i 's/UDP_OUT = ".*"/UDP_OUT = "53,113,123"/' /etc/csf/csf.conf
|
|
|
|
# Permitir acceso desde la red de Docker
|
|
RUN echo '172.16.0.0/12 # Docker network' >> /etc/csf/csf.allow && \
|
|
echo '192.168.0.0/16 # Private network' >> /etc/csf/csf.allow && \
|
|
echo '10.0.0.0/8 # Private network' >> /etc/csf/csf.allow
|
|
|
|
# Configurar rsyslog para contenedor
|
|
RUN sed -i 's/#module(load="imudp")/module(load="imudp")/' /etc/rsyslog.conf && \
|
|
sed -i 's/#input(type="imudp" port="514")/input(type="imudp" port="514")/' /etc/rsyslog.conf
|
|
|
|
# Crear script de inicio
|
|
COPY docker/csf-start.sh /usr/local/bin/csf-start.sh
|
|
RUN chmod +x /usr/local/bin/csf-start.sh
|
|
|
|
# Script de entrypoint
|
|
COPY docker/entrypoint.sh /entrypoint.sh
|
|
RUN chmod +x /entrypoint.sh
|
|
|
|
# Exponer puertos
|
|
EXPOSE 22 80 443 3000
|
|
|
|
# Variables de entorno
|
|
ENV CSF_CONFIG_PATH=/etc/csf
|
|
ENV CSF_LOG_PATH=/var/log/lfd
|
|
|
|
# Volúmenes para persistencia
|
|
VOLUME ["/etc/csf", "/var/log/lfd", "/var/lib/csf"]
|
|
|
|
# Healthcheck
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
|
|
CMD /usr/local/bin/csf --status > /dev/null 2>&1 || exit 1
|
|
|
|
# Punto de entrada
|
|
ENTRYPOINT ["/entrypoint.sh"]
|
|
CMD ["csf"] |