Statefile Manual

Name

Fail2ban - Deploy a Fail2ban server using LinuxServer.io image.

Tags

cargo, security, networking

Synopsis

nanocl state apply -s nr.next-hat.com/v0.17/fail2ban -- [--help] ARGUMENTS

nanocl state rm -s nr.next-hat.com/v0.17/fail2ban -- [--help] ARGUMENTS

Description

Fail2ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It monitors log files and bans IPs that show malicious signs, such as too many password failures, seeking for exploits, etc. Generally, Fail2ban is used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g., sending an email) can also be configured.

This cargo uses the popular LinuxServer.io fail2ban image.

By default, it will protect SSH access. You can uncomment other services in the jail.local file created at first run in the config path you provided.

Arguments

--namespace String

Nanocl namespace where to deploy the cargo. Default: system

--config-path String

Path to store fail2ban data Default: /opt/containers/fail2ban

--puid String

User ID Default: 1000

--pgid String

Group ID Default: 1000

Content

ApiVersion: v0.17
Args:
  - Name: namespace
    Kind: String
    Default: system
    Description: Nanocl namespace where to deploy the cargo.
  - Name: config-path
    Kind: String
    Default: /opt/containers/fail2ban
    Description: Path to store fail2ban data
  - Name: puid
    Kind: String
    Default: '1000'
    Description: User ID
  - Name: pgid
    Kind: String
    Default: '1000'
    Description: Group ID
Namespace: ${{ Args.namespace }}
Cargoes:
  - Name: fail2ban
    InitContainer:
      Image: busybox:latest
      HostConfig:
        Binds:
          - ${{ Args.config-path }}:${{ Args.config-path }}
      Cmd:
        - /bin/sh
        - '-c'
        - >
          mkdir -p ${{ Args.config-path }}/fail2ban

          cat <<EOF > ${{ Args.config-path }}/fail2ban/jail.local

          [DEFAULT]


          # Prevents banning LAN subnets

          ignoreip    = 127.0.0.1/8 ::1
                        10.0.0.0/8
                        172.16.0.0/12
                        192.168.0.0/16

          # "bantime.increment" allows to use database for searching of
          previously banned ip's to increase a

          # default ban time

          bantime.increment = true


          # "bantime.maxtime" is the max number of seconds using the ban time
          can reach (doesn't grow further)

          bantime.maxtime = 5w


          # "bantime.factor" is a coefficient to calculate exponent growing of
          the formula or common multiplier

          bantime.factor = 24


          # "bantime" is the number of seconds that a host is banned.

          bantime = 1h


          # A host is banned if it has generated "maxretry" during the last
          "findtime"

          # seconds.

          findtime = 24h


          # "maxretry" is the number of failures before a host get banned.

          maxretry = 3


          # The ban action "iptables-multiport" (default) should work for most

          # The ban action "iptables-allports" can be used if multiport causes
          issues

          #banaction = %(banaction_allports)s


          [sshd]

          # configuration inherits from jail.conf

          mode = aggressive

          enabled = true

          chain   = INPUT

          action  = %(known/action)s

          # logpath = %(sshd_log)s

          # backend = %(sshd_backend)s

          # maxretry = 3


          #

          #[nginx-http-auth]

          ## configuration inherits from jail.conf

          #enabled = true

          #chain   = DOCKER-USER

          #action  = %(known/action)s

          #

          #[nginx-badbots]

          ## configuration inherits from jail.d/nginx-badbots.conf

          #enabled = true

          #chain   = DOCKER-USER

          #action  = %(known/action)s

          #

          #[nginx-botsearch]

          ## configuration inherits from jail.conf

          #enabled = true

          #chain   = DOCKER-USER

          #action  = %(known/action)s

          #

          #[nginx-deny]

          ## configuration inherits from jail.d/nginx-deny.conf

          #enabled = true

          #chain   = DOCKER-USER

          #action  = %(known/action)s

          #

          #[nginx-unauthorized]

          ## configuration inherits from jail.d/nginx-unauthorized.conf

          #enabled = true

          #chain   = DOCKER-USER

          #action  = %(known/action)s
    Container:
      Image: lscr.io/linuxserver/fail2ban:latest
      Env:
        - PUID=${{ Args.puid }}
        - PGID=${{ Args.pgid }}
        - TZ=Europe/Paris
        - VERBOSITY=-vv
      HostConfig:
        NetworkMode: host
        Binds:
          - ${{ Args.config-path }}:/config
          - /var/log:/var/log:ro
        CapAdd:
          - NET_ADMIN
          - NET_RAW