Fail2ban 0.1.0 Statefile for Nanocl v0.18

Description

Fail2ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. It monitors log files and bans IPs that show malicious signs, such as too many password failures, seeking for exploits, etc. Generally, Fail2ban is used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g., sending an email) can also be configured.

This cargo uses the popular LinuxServer.io fail2ban image.

By default, it will protect SSH access. You can uncomment other services in the jail.local file created at first run in the config path you provided.

Synopsis

nanocl state apply -s nr.next-hat.com/v0.18/fail2ban/0.1.0 -- [--help] ARGUMENTS
nanocl state rm -s nr.next-hat.com/v0.18/fail2ban/0.1.0 -- [--help] ARGUMENTS

Arguments

Argument	Type	Description	Default
`--namespace` Optional	`String`	Nanocl namespace where to deploy the cargo.	`system`
`--config-path` Optional	`String`	Path to store fail2ban data	`/opt/containers/fail2ban`
`--puid` Optional	`String`	User ID	`1000`
`--pgid` Optional	`String`	Group ID	`1000`

Render locally

Render this Statefile and save the result to Statefile.yml for review before applying it.

Pass any required Statefile arguments after --.

nanocl state render -s nr.next-hat.com/v0.18/fail2ban/0.1.0 -o Statefile.yml

Content

YAML

ApiVersion: v0.18
Args:
  - Name: namespace
    Kind: String
    Default: system
    Description: Nanocl namespace where to deploy the cargo.
  - Name: config-path
    Kind: String
    Default: /opt/containers/fail2ban
    Description: Path to store fail2ban data
  - Name: puid
    Kind: String
    Default: '1000'
    Description: User ID
  - Name: pgid
    Kind: String
    Default: '1000'
    Description: Group ID
Namespace: ${{ Args.namespace }}
Cargoes:
  - Name: fail2ban
    InitContainers:
      - Name: init-config
        Image: busybox:latest
        HostConfig:
          Binds:
            - ${{ Args.config-path }}:${{ Args.config-path }}
        Cmd:
          - /bin/sh
          - -c
          - >
            mkdir -p ${{ Args.config-path }}/fail2ban

            cat <<EOF > ${{ Args.config-path }}/fail2ban/jail.local

            [DEFAULT]


            # Prevents banning LAN subnets

            ignoreip    = 127.0.0.1/8 ::1
                          10.0.0.0/8
                          172.16.0.0/12
                          192.168.0.0/16

            # "bantime.increment" allows to use database for searching of
            previously banned ip's to increase a

            # default ban time

            bantime.increment = true


            # "bantime.maxtime" is the max number of seconds using the ban time
            can reach (doesn't grow further)

            bantime.maxtime = 5w


            # "bantime.factor" is a coefficient to calculate exponent growing of
            the formula or common multiplier

            bantime.factor = 24


            # "bantime" is the number of seconds that a host is banned.

            bantime = 1h


            # A host is banned if it has generated "maxretry" during the last
            "findtime"

            # seconds.

            findtime = 24h


            # "maxretry" is the number of failures before a host get banned.

            maxretry = 3


            # The ban action "iptables-multiport" (default) should work for most

            # The ban action "iptables-allports" can be used if multiport causes
            issues

            #banaction = %(banaction_allports)s


            [sshd]

            # configuration inherits from jail.conf

            mode = aggressive

            enabled = true

            chain   = INPUT

            action  = %(known/action)s

            # logpath = %(sshd_log)s

            # backend = %(sshd_backend)s

            # maxretry = 3


            #

            #[nginx-http-auth]

            ## configuration inherits from jail.conf

            #enabled = true

            #chain   = DOCKER-USER

            #action  = %(known/action)s

            #

            #[nginx-badbots]

            ## configuration inherits from jail.d/nginx-badbots.conf

            #enabled = true

            #chain   = DOCKER-USER

            #action  = %(known/action)s

            #

            #[nginx-botsearch]

            ## configuration inherits from jail.conf

            #enabled = true

            #chain   = DOCKER-USER

            #action  = %(known/action)s

            #

            #[nginx-deny]

            ## configuration inherits from jail.d/nginx-deny.conf

            #enabled = true

            #chain   = DOCKER-USER

            #action  = %(known/action)s

            #

            #[nginx-unauthorized]

            ## configuration inherits from jail.d/nginx-unauthorized.conf

            #enabled = true

            #chain   = DOCKER-USER

            #action  = %(known/action)s

            EOF
    Containers:
      - Name: fail2ban
        Image: lscr.io/linuxserver/fail2ban:latest
        Env:
          - PUID=${{ Args.puid }}
          - PGID=${{ Args.pgid }}
          - TZ=Europe/Paris
          - VERBOSITY=-vv
        HostConfig:
          NetworkMode: host
          Binds:
            - ${{ Args.config-path }}:/config
            - /var/log:/var/log:ro
          CapAdd:
            - NET_ADMIN
            - NET_RAW