Fix: harmonize Firewall and Fail2ban status, decouple strict mode and fix installer jail generation

scripts/fix.sh

@@ -28,18 +28,7 @@ chmod 0664 /var/log/asterisk/messages /var/log/asterisk/security.log 2>/dev/null
 chown www-data:asterisk /var/log/nexus_security.log 2>/dev/null || true
 chmod 0664 /var/log/nexus_security.log 2>/dev/null || true
 
-echo "-> Filtres Fail2ban Asterisk & Nexus-Web..."
-cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf
-[INCLUDES]
-before = common.conf
-
-[Definition]
-failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'<HOST>'(?::\d+)?
-            ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)/<HOST>/\d+"
-ignoreregex =
-EOF
-chmod 0644 /etc/fail2ban/filter.d/asterisk.conf
-
+echo "-> Filtres Fail2ban Nexus-Web..."
 cat << 'EOF' > /etc/fail2ban/filter.d/nexus-web.conf
 [Definition]
 failregex = ^.*\[NEXUS-WEB-AUTH-FAIL\]:\s*<HOST>.*$
@@ -47,40 +36,21 @@ ignoreregex =
 EOF
 chmod 0644 /etc/fail2ban/filter.d/nexus-web.conf
 
-cat << 'EOF' > /etc/fail2ban/jail.local
-[DEFAULT]
-bantime = 3600
-findtime = 600
-maxretry = 3
-usedns = no
-ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
-
-[asterisk]
-enabled = true
-port = 5060,5061
-protocol = udp
-filter = asterisk
-logpath = /var/log/asterisk/messages
-action = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
-maxretry = 3
-bantime = 3600
-
-[nginx-http-auth]
-enabled = true
-port = http,https,8443
-logpath = /var/log/nginx/*error.log
-maxretry = 5
-bantime = 3600
-
-[nexus-web]
-enabled = true
-port = http,https,8443
-filter = nexus-web
-logpath = /var/log/nexus_security.log
-maxretry = 3
-findtime = 600
-bantime = 3600
-EOF
+echo "-> Génération et application de /etc/fail2ban/jail.local..."
+php -r '
+require_once "/var/www/nexus-pbx/src/Database.php";
+require_once "/var/www/nexus-pbx/src/FirewallManager.php";
+$st = App\FirewallManager::getSettings();
+App\FirewallManager::generateJailLocal(
+    $st["fail2ban_whitelist_ips"],
+    (int)$st["fail2ban_sip_maxretry"],
+    (int)$st["fail2ban_sip_findtime"],
+    (int)$st["fail2ban_sip_bantime"],
+    (int)$st["fail2ban_web_maxretry"],
+    (int)$st["fail2ban_web_bantime"],
+    (int)$st["admin_https_port"]
+);
+' 2>/dev/null || true
 
 echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..."
 usermod -aG asterisk www-data 2>/dev/null || true
@@ -112,7 +82,7 @@ chmod 0664 /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/
 setfacl -m u:www-data:rw /etc/fail2ban/jail.local /etc/nginx/sites-available/nexus-pbx 2>/dev/null || true
 
 cat << 'EOF' > /etc/sudoers.d/nexus-pbx
-www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables
+www-data ALL=(ALL) NOPASSWD: /usr/sbin/asterisk, /usr/sbin/nginx, /usr/bin/systemctl, /usr/bin/fail2ban-client, /bin/fail2ban-client, /var/www/nexus-pbx/scripts/nexus-firewall, /usr/bin/certbot, /usr/sbin/nft, /usr/sbin/iptables
 EOF
 chmod 0440 /etc/sudoers.d/nexus-pbx