diff --git a/docker-compose.yml b/docker-compose.yml index 6bcdc30..1f452e1 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,8 +10,8 @@ services: - /bin/bash - /etc/fail2ban/entrypoint.sh volumes: - - ./fail2ban/entrypoint.sh:/etc/fail2ban/entrypoint.sh - - ./fail2ban/sshd_config:/etc/ssh/sshd_config + - ./fail2ban/entrypoint.sh:/etc/fail2ban/entrypoint.sh:ro + - ./fail2ban/sshd_config:/etc/ssh/sshd_config:ro ports: - 22:22/tcp - 2222:2222/tcp diff --git a/fail2ban/entrypoint.sh b/fail2ban/entrypoint.sh index a1bc394..10ce10f 100644 --- a/fail2ban/entrypoint.sh +++ b/fail2ban/entrypoint.sh @@ -12,19 +12,19 @@ REMOTE_IP=\"\$1\" SENDER_MAIL=\"\$2\" DEST_MAIL=\"\$3\" LOGFILE=\"\$4\" -DATE=\$\(date\) -WHOIS_OUTPUT=\$\(whois \$REMOTE_IP\) -REVERSE_IP=\$\(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for \(i = NF; i > 0; i--\){print \$i}}'\) -LOG_LINES=\$\(grep \$REMOTE_IP \$LOGFILE\) +DATE=\$(date) +WHOIS_OUTPUT=\$(whois \$REMOTE_IP) +REVERSE_IP=\$(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for (i = NF; i > 0; i--){print \$i}}') +LOG_LINES=\$(grep \$REMOTE_IP \$LOGFILE) BANNED_IP_PATH=\"/var/tmp/fail2ban_banned_ips\" # Skip sending email when an email was already sent out for that IP the last 24hours if ! [ -d \$BANNED_IP_PATH ]; then mkdir \$BANNED_IP_PATH; else find \${BANNED_IP_PATH}/ -mtime +30 -type f -delete; fi -if [ -n \"\$\(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null\)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi +if [ -n \"\$(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi # Get the Abuse email address from Abusix -if DNS_REPLY=\$\(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org\); then - ABUSE_ADDR=\$\(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\"\) +if DNS_REPLY=\$(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org); then + ABUSE_ADDR=\$(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\") fi # Send email @@ -44,7 +44,7 @@ WHOIS report FYI: Thanks for your time and curiosity... take care with botnets... - ANTIBOTNET SYSTEM - -together will do a better and free world :-\) +together will do a better and free world :-) from postmaster@$DOMAIN by www.$DOMAIN\" fi" > fail2ban_abuse_mail.sh