README.md

@@ -1,17 +1,17 @@
-# fail2ban with abuse reporting system
+# HatThieves `fail2ban` with abuse reporting system
 
 ## Config
 
-edit [entrypoint.sh](fail2ban/entrypoint.sh) with your smtp settings
+#### edit [entrypoint.sh](fail2ban/entrypoint.sh) with your smtp settings
 
 ## Expose jail
-
+```
-    docker-compose up -d
+docker-compose up -d
+```
 
 ## Stop jail
+```
+docker-compose down
+```
 
-    docker-compose down
+### License MIT
-
-## License
-
-    MIT

docker-compose.yml

@@ -3,7 +3,6 @@ version: '2'
 services:
   fail2ban:
     build: ./fail2ban
-    image: fail2ban
     hostname: fail2ban
     container_name: fail2ban
     restart: always
@@ -13,15 +12,7 @@ services:
     volumes:
       - ./fail2ban/entrypoint.sh:/etc/fail2ban/entrypoint.sh:ro
       - ./fail2ban/sshd_config:/etc/ssh/sshd_config:ro
-      - ./fail2ban/fail2ban.log:/var/log/fail2ban.log
     cap_add:
       - NET_ADMIN
       - NET_RAW
-    ports:
+    network_mode: host
-      - "22:22/tcp"
-      - "2222:2222/tcp"
-    networks:
-      failnet:
-
-networks:
-  failnet:

fail2ban/Dockerfile

@@ -1,3 +1,3 @@
 FROM debian:sid-slim
-RUN apt update && apt -y upgrade && apt -y install fail2ban openssh-server rsyslog swaks host python3-pyinotify iptables tor torsocks && apt clean
+RUN apt update && apt -y upgrade && apt -y install fail2ban openssh-server rsyslog swaks host python3-pyinotify iptables && apt clean
 WORKDIR /etc/fail2ban

fail2ban/entrypoint.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
-DOMAIN=manalejandro.com
+DOMAIN=hatthieves.es
-SMTP=smtp.manalejandro.com
+SMTP=smtp.hatthieves.es
 USER=fail2ban
 PASS=pass
 
@@ -13,9 +13,9 @@ SENDER_MAIL=\"\$2\"
 DEST_MAIL=\"\$3\"
 LOGFILE=\"\$4\"
 DATE=\$(date)
-WHOIS_OUTPUT=\$(torsocks whois \$REMOTE_IP)
+WHOIS_OUTPUT=\$(whois \$REMOTE_IP)
 REVERSE_IP=\$(echo \$REMOTE_IP | awk 'BEGIN{FS=\".\";ORS=\".\"} {for (i = NF; i > 0; i--){print \$i}}')
-LOG_LINES=\$(grep -a \$REMOTE_IP \$LOGFILE)
+LOG_LINES=\$(grep \$REMOTE_IP \$LOGFILE)
 BANNED_IP_PATH=\"/var/tmp/fail2ban_banned_ips\"
 
 # Skip sending email when an email was already sent out for that IP the last 24hours
@@ -23,17 +23,15 @@ if ! [ -d \$BANNED_IP_PATH ]; then mkdir \$BANNED_IP_PATH; else find \${BANNED_I
 if [ -n \"\$(find \${BANNED_IP_PATH}/\$REMOTE_IP -mtime -1 2>/dev/null)\" ]; then exit 0; else touch \${BANNED_IP_PATH}/\$REMOTE_IP; fi
 
 # Get the Abuse email address from Abusix
-#if DNS_REPLY=\$(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.zone); then
+if DNS_REPLY=\$(host -t TXT \${REVERSE_IP}abuse-contacts.abusix.org); then
-#  ABUSE_ADDR=\$(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\")
+  ABUSE_ADDR=\$(echo \$DNS_REPLY | grep -Eio '\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b' | paste -sd \",\")
-#fi
+fi
-
-ABUSE_ADDR=\$(torsocks whois -b \$REMOTE_IP | egrep ^abuse | sed 's/^.*: \?\+//')
 
 # Send email
 if [ \$ABUSE_ADDR ]; then
-swaks -f \$SENDER_MAIL -t \"\$ABUSE_ADDR\" -tlsc -a -au $USER -ap $PASS -s $SMTP -p 465 \\
+swaks -f \$SENDER_MAIL -t \"\$ABUSE_ADDR,webmaster@$DOMAIN\" --tlsc -au $USER -ap $PASS -s $SMTP -p 465 \\
 --h-Subject \"[Urgent]: Automatic abuse report for IP address \$REMOTE_IP from $DOMAIN\" --h-From \"Fail2Ban $DOMAIN <\$SENDER_MAIL>\" \\
---h-To \$ABUSE_ADDR --body \\
+--h-Bcc \"webmaster@$DOMAIN\" --h-To \$ABUSE_ADDR --body \\
 \"This is an automatic email abuse report about the IP address \$REMOTE_IP generated at \$DATE, please do not reply.
 You get this email because you are listed as the official and popular abuse email contact for this concrete IP address.
 
@@ -43,8 +41,11 @@ The following intrusion attempts were detected by our systems:
 WHOIS report FYI:
 \$WHOIS_OUTPUT
 
+Thanks for your time and curiosity... take care with botnets...
 - ANTIBOTNET SYSTEM -
-from postmaster@$DOMAIN by $DOMAIN\"
+together will do a better and free world :-)
+from postmaster@$DOMAIN
+by www.$DOMAIN\"
 fi" > fail2ban_abuse_mail.sh
 
 echo "[Definition]
@@ -122,13 +123,14 @@ maxretry = 2
 ignoreip = $DOMAIN
 backend = pyinotify
 filter = sshd
-action = iptables-allports[name=SSH, protocol=tcp]
+action = iptables-allports
          sendmail-abuse[name=%(__name__)s, dest=\"%(destemail)s\", logpath=%(logpath)s]" > jail.d/sshd.conf
 
+chmod +x fail2ban_abuse_mail.sh
 rm -f /etc/fail2ban/jail.d/defaults-debian.conf /var/run/fail2ban/fail2ban.sock
 mkdir -p /var/run/fail2ban
-service rsyslog start
+/etc/init.d/rsyslog start
-service ssh start
+/etc/init.d/ssh start
-service fail2ban start
+/etc/init.d/fail2ban start
-service tor start
 /bin/sleep infinity
+