#!/bin/bash
DOMAIN=hatthieves.es
SMTP=smtp.hatthieves.es
USER=fail2ban
PASS=f41l2b4n.

echo "#!/bin/bash

PATH=\"\$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"
LANG=\"C\"
REMOTE_IP=\"\$1\"
SENDER_MAIL=\"\$2\"
DEST_MAIL=\"\$3\"
LOGFILE=\"\$4\"
DATE=\$(date)
WHOIS_OUTPUT=\$(whois \$REMOTE_IP)
REVERSE_IP=\$(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for (i = NF; i > 0; i--){print \$i}}')
LOG_LINES=\$(grep \$REMOTE_IP \$LOGFILE)
BANNED_IP_PATH=\"/var/tmp/fail2ban_banned_ips\"

# Skip sending email when an email was already sent out for that IP the last 24hours
if ! [ -d \$BANNED_IP_PATH ]; then mkdir \$BANNED_IP_PATH; else find \${BANNED_IP_PATH}/ -mtime +30 -type f -delete; fi
if [ -n \"\$(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi

# Get the Abuse email address from Abusix
if DNS_REPLY=\$(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org); then
  ABUSE_ADDR=\$(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\")
fi

# Send email
if [ \$ABUSE_ADDR ]; then

DOMAINSOCIAL=\"https://social.hatthieves.es\"
USERNAME=\"fail2ban\"
PASSWORD=\"f41l2b4n.\"
CLIENT_NAME=\"Fail2Ban\"

#APP_DATA=\$(curl -s -X POST -d \"client_name=\$CLIENT_NAME\" -d \"redirect_uris=urn:ietf:wg:oauth:2.0:oob\" -d \"scopes=write read\" \$DOMAINSOCIAL/api/v1/apps)

#CLIENT_ID=\$(echo \$APP_DATA | cut -d \":\" -f 2 | cut -d \"\\\"\" -f 2)
#CLIENT_SECRET=\$(echo \$APP_DATA | cut -d \":\" -f 3 | cut -d \"\\\"\" -f 2)

#ACCESS_TOKEN=\$(curl -s -X POST --data-urlencode \"client_id=\$CLIENT_ID\" --data-urlencode \"client_secret=\$CLIENT_SECRET\" -d \"grant_type=password\" -d \"username=\$USERNAME\" --data-urlencode \"password=\$PASSWORD\" -Ss \$DOMAINSOCIAL/oauth/token | rev | cut -d \"\\\"\" -f 2 | rev)

STATUS=\"This is an automatic abuse report about the IP address \$REMOTE_IP generated at \$DATE, please do not reply.

The following intrusion attempts were detected by our systems:
\$LOG_LINES

- ANTIBOTNET SYSTEM -
from postmaster@$DOMAIN
https://gitea.hatthieves.es/cloud/fail2ban by www.$DOMAIN\"
#curl -H \"Authorization: Bearer \$ACCESS_TOKEN\" -X POST --data-urlencode \"status=\$STATUS\" -Ss \$DOMAINSOCIAL/api/v1/statuses
##curl -X POST --data-urlencode \"status=\$STATUS\" -Ss https://\$USERNAME:\$PASSWORD@social.hatthieves.es/api/v1/statuses

swaks -f \$SENDER_MAIL -t \"\$ABUSE_ADDR,webmaster@$DOMAIN\" -tlsc -a -au $USER -ap $PASS -s $SMTP -p 587 \\
--h-Subject \"[Urgent]: Automatic abuse report for IP address \$REMOTE_IP from $DOMAIN\" --h-From \"Fail2Ban $DOMAIN <\$SENDER_MAIL>\" \\
--h-Bcc \"webmaster@$DOMAIN\" --h-To \$ABUSE_ADDR --body \\
\"This is an automatic email abuse report about the IP address \$REMOTE_IP generated at \$DATE, please do not reply.
You get this email because you are listed as the official and popular abuse email contact for this concrete IP address.

The following intrusion attempts were detected by our systems:
\$LOG_LINES

WHOIS report FYI:
\$WHOIS_OUTPUT

Thanks for your time and curiosity... take care with botnets...
- ANTIBOTNET SYSTEM -
together will do a better and free world :-)
from postmaster@$DOMAIN
https://gitea.hatthieves.es/cloud/fail2ban by www.$DOMAIN\"
fi" > fail2ban_abuse_mail.sh

echo "[Definition]
 
# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart = printf %%b \"Subject: [Fail2Ban] <name>: started
              Date: \`date -u +\"%%a, %%d %%h %%Y %%T +0000\"\`
              From: Fail2Ban <<sender>>
              To: <dest>\\n
              Hi,\\n
              The jail <name> has been started successfully.\\n
              Regards,\\n
              Fail2Ban\" | /usr/sbin/sendmail -f <sender> <dest>
 
# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop = printf %%b \"Subject: [Fail2Ban] <name>: stopped
             Date: \`date -u +\"%%a, %%d %%h %%Y %%T +0000\"\`
             From: Fail2Ban <<sender>>
             To: <dest>\\n
             Hi,\\n
             The jail <name> has been stopped.\\n
             Regards,\\n
             Fail2Ban\" | /usr/sbin/sendmail -f <sender> <dest>
 
# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =
 
# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
actionban = /etc/fail2ban/fail2ban_abuse_mail.sh <ip> <sender> <dest> <logpath>
 
# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    <ip>  IP address
#          <failures>  number of failures
#          <time>  unix timestamp of the ban time
# Values:  CMD
#
actionunban =
 
[Init]
 
# Defaut name of the chain
#
name = default
 
# Destination/Addressee of the mail
#
dest = webmaster@$DOMAIN
 
# Sender of the mail
#
sender = fail2ban@$DOMAIN
 
# Path to the log files which contain relevant lines for the abuser IP
#
logpath = /dev/null" > action.d/sendmail-abuse.conf

echo "[sshd]
enabled = true
bantime = 10800
findtime = 1800
maxretry = 3
ignoreip = $DOMAIN
backend = pyinotify
filter = sshd
action = iptables-allports
         sendmail-abuse[name=%(__name__)s, dest=\"%(destemail)s\", logpath=%(logpath)s]" > jail.d/sshd.conf

chmod +x fail2ban_abuse_mail.sh
rm -f /etc/fail2ban/jail.d/defaults-debian.conf /var/run/fail2ban/fail2ban.sock
/etc/init.d/rsyslog start
/etc/init.d/ssh start
mkdir -p /var/run/fail2ban
/etc/init.d/fail2ban start
/bin/sleep infinity

