sorcier/NexusPBX
1
0 Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: harmonize Firewall and Fail2ban status, decouple strict mode and fix installer jail generation

Browse Source
This commit is contained in:
sorcier committed 2026-11-02 10:59:46 +01:00
1 parent 8bbeb9caae
commit 8b57981b1b
6 files changed
+69 -121
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/FirewallManager.php
+23 -14
View File
@@ -73,16 +73,22 @@ class FirewallManager
$settings = self::getSettings();
// 1. Détection service Fail2ban (avec timeout strict de 2s anti-blocage)
exec('timeout 2 sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
$isRunning = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
// 1. Détection service Fail2ban (Statut Systemd + vérification socket ping)
$sysActive = trim((string)@shell_exec('systemctl is-active fail2ban 2>/dev/null')) === 'active';
$pingCode = -1;
$pingOut = [];
if ($sysActive) {
exec('timeout 2 sudo -n /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
}
$pingOk = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
$isRunning = $sysActive || $pingOk;
$jails = [];
$bannedList = [];
$totalBannedCount = 0;
if ($isRunning) {
exec('timeout 2 sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
if ($isRunning && $pingOk) {
exec('timeout 2 sudo -n /usr/bin/fail2ban-client status 2>&1', $statOut);
$statStr = implode("\n", $statOut);
// Extraction des prisons actives
@@ -138,7 +144,7 @@ class FirewallManager
$unbannedFrom = [];
if ($jail !== '' && $jail !== 'all') {
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
if ($code === 0) {
$unbannedFrom[] = $jail;
@@ -146,7 +152,7 @@ class FirewallManager
} else {
// Débannir de toutes les prisons connues
foreach (['asterisk', 'nexus-web', 'sshd'] as $j) {
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
if ($code === 0) {
$unbannedFrom[] = $j;
@@ -175,7 +181,7 @@ class FirewallManager
}
$jail = trim($jail) ?: 'asterisk';
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo -n /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
@unlink('/tmp/nexus_fw_status_cache.json');
@@ -195,7 +201,7 @@ class FirewallManager
$db = Database::getConnection();
$strictPort80 = !empty($data['certbot_strict_port80']) ? 1 : 0;
$firewallEnabled = (!empty($data['firewall_enabled']) || $strictPort80 === 1) ? 1 : 0;
$firewallEnabled = isset($data['firewall_enabled']) ? (!empty($data['firewall_enabled']) ? 1 : 0) : 1;
$adminPort = max(1, min(65535, (int)($data['admin_https_port'] ?? 8443)));
$sipMaxRetry = max(1, min(20, (int)($data['fail2ban_sip_maxretry'] ?? 3)));
$sipFindTime = max(60, min(86400, (int)($data['fail2ban_sip_findtime'] ?? 600)));
@@ -253,8 +259,11 @@ class FirewallManager
$adminPort
);
// 3. Rechargement de Fail2ban (timeout 3s)
exec('timeout 3 sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
// 3. Rechargement / Redémarrage propre de Fail2ban
exec('timeout 3 sudo -n /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
if ($f2bCode !== 0) {
exec('timeout 5 sudo -n /usr/bin/systemctl restart fail2ban 2>&1');
}
// 4. Mise à jour de la configuration Nginx
self::applyNginxConfig($adminPort, $strictPort80);
@@ -482,18 +491,18 @@ EOF;
@chmod(self::NGINX_CONF_PATH, 0664);
// Test de syntaxe
exec('sudo /usr/sbin/nginx -t 2>&1', $tOut, $tCode);
exec('sudo -n /usr/sbin/nginx -t 2>&1', $tOut, $tCode);
if ($tCode !== 0) {
throw new RuntimeException("Erreur de syntaxe Nginx : " . implode("\n", $tOut));
}
// Rechargement Nginx sans coupure
exec('sudo /usr/bin/systemctl reload nginx 2>&1');
exec('sudo -n /usr/bin/systemctl reload nginx 2>&1');
}
private static function getJailDetails(string $jail): array
{
exec('timeout 2 sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
exec('timeout 2 sudo -n /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
$str = implode("\n", $out);
$currentlyFailed = 0;
src/SystemMetrics.php
+3 -3
View File
@@ -135,10 +135,10 @@ class SystemMetrics
$nginxActive = ($lines[1] ?? '') === 'active';
$phpActive = ($lines[2] ?? '') === 'active';
$f2bActive = ($lines[3] ?? '') === 'active' || !empty($fwStatus['is_running']);
$isF2bRunning = !empty($fwStatus['is_running']) && (($lines[3] ?? '') === 'active');
$fwEnabled = !empty($fwStatus['settings']['firewall_enabled']) && $isF2bRunning;
$fwEnabled = !empty($fwStatus['settings']['firewall_enabled']) && $nginxActive;
$adminPort = $fwStatus['settings']['admin_https_port'] ?? 8443;
$isStrictPort80 = !empty($fwStatus['settings']['certbot_strict_port80']);
return [
[
@@ -180,7 +180,7 @@ class SystemMetrics
[
'id' => 'firewall',
'name' => 'Pare-feu & Filtrage',
'desc' => $fwEnabled ? 'Règles actives & Isolation 80' : 'Inactif (Tout autoriser)',
'desc' => $fwEnabled ? ($isStrictPort80 ? 'Mode Strict (Port 80 Isolé)' : 'Filtrage Nginx & Ports Actif') : 'Inactif (Tout autoriser)',
'port' => 'Filtrage IP & Nginx',
'active' => $fwEnabled,
'status_text' => $fwEnabled ? 'Filtrage Actif' : 'Inactif',