2f9a236021
- /home/.chezmoiscripts/run_onchange_after_add-fonts.tmpl - /home/.chezmoiscripts/run_onchange_after_endlessh.tmpl - /home/.chezmoiscripts/run_onchange_after_fail2ban.tmpl - /home/.chezmoiscripts/run_onchange_after_symlink-ansible-configs.tmpl - /home/.chezmoiscripts/run_onchange_after_sshd.tmpl - /home/.chezmoiscripts/run_onchanges_after_decrypt-ssh-keys.tmpl - /home/.chezmoiscripts/run_onchange_ensure-executable.tmpl - /home/.chezmoiscripts/run_onchanges_after_ensure-private-key.tmpl - /home/.chezmoiscripts/run_onchanges_after_generate-public-keys.tmpl - /home/.chezmoiscripts/run_onchanges_after_symlink-custom.tmpl - /home/.chezmoitemplates/ssh/authorized-keys.yubikey - /home/.chezmoiscripts/universal/run_onchange_after_24-vpn-darwin.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_20-font.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_02-ensure-executable.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_05-decrypt-ssh-keys.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_07-ensure-private-key.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_08-generate-public-keys.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_08-symlink-custom.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_24-vpn-darwin.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_30-endlessh.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_30-sshd.sh.tmpl - /home/.chezmoiscripts/universal/run_onchange_after_31-fail2ban.sh.tmpl - /home/.chezmoiscripts/disabled/run_onchange_after_symlink-ansible-configs.tmpl - /home/.chezmoiscripts/linux/run_onchange_before_01-requirements.sh.tmpl - /home/.chezmoiscripts/linux/run_onchange_before_10-system-tweaks.sh.tmpl - /home/.chezmoiscripts/linux/run_onchange_before_11-configure-swap.sh.tmpl - /home/.chezmoiscripts/linux/run_onchange_before_14-warp.sh.tmpl - /home/.chezmoitemplates/ssh/encrypted_authorized-keys.yubikey.tmpl
52 lines
2.1 KiB
Cheetah
52 lines
2.1 KiB
Cheetah
{{- if eq .host.distro.family "linux" -}}
|
|
#!/usr/bin/env bash
|
|
# @file Fail2ban Configuration
|
|
# @brief Applies the system `fail2ban` jail configuration and then restarts the service
|
|
# @description
|
|
# Fail2ban is an SSH security program that temporarily bans IP addresses that could possibly be
|
|
# attempting to gain unauthorized system access. This script applies the "jail" configuration
|
|
# located at `home/private_dot_ssh/fail2ban/` to the system location. It then enables and restarts
|
|
# the `fail2ban` configuration.
|
|
#
|
|
# ## Links
|
|
#
|
|
# * [`fail2ban` configuration folder](https://github.com/megabyte-labs/install.doctor/tree/master/home/private_dot_ssh/fail2ban)
|
|
|
|
# jail.local hash: {{- include (joinPath .host.home ".ssh" "fail2ban" "jail.local") | sha256sum -}}
|
|
|
|
{{ includeTemplate "universal/profile" }}
|
|
{{ includeTemplate "universal/logg" }}
|
|
|
|
### Restart fail2ban
|
|
function restartFail2Ban() {
|
|
if [ -d /Applications ] && [ -d /System ]; then
|
|
# macOS
|
|
logg info 'Enabling the `fail2ban` Homebrew service'
|
|
brew services start fail2ban
|
|
else
|
|
# Linux
|
|
logg info 'Enabling the `fail2ban` service'
|
|
sudo systemctl enable fail2ban
|
|
logg info 'Restarting the `fail2ban` service'
|
|
sudo systemctl restart fail2ban
|
|
fi
|
|
}
|
|
|
|
### Update the jail.local file if environment is not WSL
|
|
if [[ ! "$(test -d /proc && grep Microsoft /proc/version > /dev/null)" ]]; then
|
|
if [ -d /etc/fail2ban ]; then
|
|
logg info 'Copying ~/.ssh/fail2ban/jail.local to /etc/fail2ban/jail.local'
|
|
sudo cp -f "$HOME/.ssh/fail2ban/jail.local" /etc/fail2ban/jail.local
|
|
restartFail2Ban
|
|
elif [ -d /usr/local/etc/fail2ban ]; then
|
|
logg info 'Copying ~/.ssh/fail2ban/jail.local to /usr/local/etc/fail2ban/jail.local'
|
|
sudo cp -f "$HOME/.ssh/fail2ban/jail.local" /usr/local/etc/fail2ban/jail.local
|
|
restartFail2Ban
|
|
else
|
|
logg warn 'Both the /etc/fail2ban (Linux) and the /usr/local/etc/fail2ban (macOS) folder do not exist'
|
|
fi
|
|
else
|
|
logg info 'Skipping sshd_config application since environment is WSL'
|
|
fi
|
|
|
|
{{ end -}}
|