From 8bbeb9caae411a1e76fc5fc79ae42b5ee71abbf5 Mon Sep 17 00:00:00 2001 From: sorcier Date: Mon, 2 Nov 2026 08:56:27 +0100 Subject: [PATCH] Fix: usedns=no in fail2ban, exact quoted host regex for asterisk, and timeout 2 on all fail2ban-client calls --- install.sh | 3 ++- scripts/fix.sh | 37 ++++++++++++++++++++++++++++++++++++- src/FirewallManager.php | 19 ++++++++++--------- 3 files changed, 48 insertions(+), 11 deletions(-) diff --git a/install.sh b/install.sh index e8cc8ae..ad3c823 100755 --- a/install.sh +++ b/install.sh @@ -361,7 +361,7 @@ cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf before = common.conf [Definition] -failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?(?::\d+)?'? +failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?''(?::\d+)? ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)//\d+" ignoreregex = EOF @@ -380,6 +380,7 @@ cat << 'EOF' > /etc/fail2ban/jail.local bantime = 3600 findtime = 600 maxretry = 3 +usedns = no ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 [asterisk] diff --git a/scripts/fix.sh b/scripts/fix.sh index 8e4bfe6..8f23089 100755 --- a/scripts/fix.sh +++ b/scripts/fix.sh @@ -34,7 +34,7 @@ cat << 'EOF' > /etc/fail2ban/filter.d/asterisk.conf before = common.conf [Definition] -failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?'?(?::\d+)?'? +failregex = ^(%(__prefix_line)s|\[\]\s*)*(?:NOTICE|SECURITY)\[\d+\]:? (?:\S+: )?(?:Registration from |Call from |Invalid password for |Sending fake auth challenge to |No matching endpoint found for )?''(?::\d+)? ^(%(__prefix_line)s|\[\]\s*)*SECURITY\[\d+\]:? (?:\S+: )?SecurityEvent="(?:FailedACL|InvalidAccountID|ChallengeResponseFailed|InvalidPassword|AuthFailed)"(?:.*?)RemoteAddress="IPV[46]/(?:UDP|TCP|TLS)//\d+" ignoreregex = EOF @@ -47,6 +47,41 @@ ignoreregex = EOF chmod 0644 /etc/fail2ban/filter.d/nexus-web.conf +cat << 'EOF' > /etc/fail2ban/jail.local +[DEFAULT] +bantime = 3600 +findtime = 600 +maxretry = 3 +usedns = no +ignoreip = 127.0.0.1/8 ::1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 + +[asterisk] +enabled = true +port = 5060,5061 +protocol = udp +filter = asterisk +logpath = /var/log/asterisk/messages +action = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] +maxretry = 3 +bantime = 3600 + +[nginx-http-auth] +enabled = true +port = http,https,8443 +logpath = /var/log/nginx/*error.log +maxretry = 5 +bantime = 3600 + +[nexus-web] +enabled = true +port = http,https,8443 +filter = nexus-web +logpath = /var/log/nexus_security.log +maxretry = 3 +findtime = 600 +bantime = 3600 +EOF + echo "-> Droits applicatifs et ACL POSIX (/etc/asterisk et /var/www/nexus-pbx)..." usermod -aG asterisk www-data 2>/dev/null || true usermod -aG www-data asterisk 2>/dev/null || true diff --git a/src/FirewallManager.php b/src/FirewallManager.php index 6c41094..86517bb 100644 --- a/src/FirewallManager.php +++ b/src/FirewallManager.php @@ -73,8 +73,8 @@ class FirewallManager $settings = self::getSettings(); - // 1. Détection service Fail2ban - exec('sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode); + // 1. Détection service Fail2ban (avec timeout strict de 2s anti-blocage) + exec('timeout 2 sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode); $isRunning = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong')); $jails = []; @@ -82,7 +82,7 @@ class FirewallManager $totalBannedCount = 0; if ($isRunning) { - exec('sudo /usr/bin/fail2ban-client status 2>&1', $statOut); + exec('timeout 2 sudo /usr/bin/fail2ban-client status 2>&1', $statOut); $statStr = implode("\n", $statOut); // Extraction des prisons actives @@ -138,7 +138,7 @@ class FirewallManager $unbannedFrom = []; if ($jail !== '' && $jail !== 'all') { - $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1"; + $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1"; exec($cmd, $out, $code); if ($code === 0) { $unbannedFrom[] = $jail; @@ -146,7 +146,7 @@ class FirewallManager } else { // Débannir de toutes les prisons connues foreach (['asterisk', 'nexus-web', 'sshd'] as $j) { - $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1"; + $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1"; exec($cmd, $out, $code); if ($code === 0) { $unbannedFrom[] = $j; @@ -175,7 +175,7 @@ class FirewallManager } $jail = trim($jail) ?: 'asterisk'; - $cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1"; + $cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1"; exec($cmd, $out, $code); @unlink('/tmp/nexus_fw_status_cache.json'); @@ -253,8 +253,8 @@ class FirewallManager $adminPort ); - // 3. Rechargement de Fail2ban - exec('sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode); + // 3. Rechargement de Fail2ban (timeout 3s) + exec('timeout 3 sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode); // 4. Mise à jour de la configuration Nginx self::applyNginxConfig($adminPort, $strictPort80); @@ -291,6 +291,7 @@ ignoreip = {$whitelist} findtime = {$sipFindTime} bantime = {$sipBanTime} maxretry = {$sipMaxRetry} +usedns = no [sshd] enabled = true @@ -492,7 +493,7 @@ EOF; private static function getJailDetails(string $jail): array { - exec('sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out); + exec('timeout 2 sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out); $str = implode("\n", $out); $currentlyFailed = 0;