Skip to content

Commit 6363b7f

Browse files
jchiarullijchiarulli
authored
fix: create ssh jail file to fix and configure fail2ban (#67)
1 parent 2595774 commit 6363b7f

File tree

4 files changed

+114
-37
lines changed

4 files changed

+114
-37
lines changed

‎cmd/install.go

+40-37
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,10 @@ var installCmd = &cobra.Command{
9191
// Step 2: Configure the firewall
9292
network.ConfigureFirewall()
9393

94-
// Setp 3: Create relay user
94+
// Step 3: Configure the intrusion detection system
95+
network.ConfigureIntrusionDetection()
96+
97+
// Setp 4: Create relay user
9598
spinner, _ := pterm.DefaultSpinner.Start(fmt.Sprintf("Checking if '%s' user exists...", relays.User))
9699
if !users.UserExists(relays.User) {
97100
spinner.UpdateText(fmt.Sprintf("Creating '%s' user...", relays.User))
@@ -102,118 +105,118 @@ var installCmd = &cobra.Command{
102105
}
103106

104107
if selectedRelayOption == khatru_pyramid.RelayName {
105-
// Step 4: Configure Nginx for HTTP
108+
// Step 5: Configure Nginx for HTTP
106109
khatru_pyramid.ConfigureNginxHttp(relayDomain)
107110

108-
// Step 5: Get SSL/TLS certificates
111+
// Step 6: Get SSL/TLS certificates
109112
httpsEnabled := network.GetCertificates(relayDomain)
110113
if httpsEnabled {
111-
// Step 6: Configure Nginx for HTTPS
114+
// Step 7: Configure Nginx for HTTPS
112115
khatru_pyramid.ConfigureNginxHttps(relayDomain)
113116
}
114117

115-
// Step 7: Download and install the relay binary
118+
// Step 8: Download and install the relay binary
116119
khatru_pyramid.InstallRelayBinary(pubKey)
117120

118-
// Step 8: Set up the relay service
121+
// Step 9: Set up the relay service
119122
khatru_pyramid.SetupRelayService(relayDomain, pubKey, relayContact)
120123

121-
// Step 9: Show success messages
124+
// Step 10: Show success messages
122125
khatru_pyramid.SuccessMessages(relayDomain, httpsEnabled)
123126
} else if selectedRelayOption == nostr_rs_relay.RelayName {
124-
// Step 4: Configure Nginx for HTTP
127+
// Step 5: Configure Nginx for HTTP
125128
nostr_rs_relay.ConfigureNginxHttp(relayDomain)
126129

127-
// Step 5: Get SSL/TLS certificates
130+
// Step 6: Get SSL/TLS certificates
128131
httpsEnabled := network.GetCertificates(relayDomain)
129132
if httpsEnabled {
130-
// Step 6: Configure Nginx for HTTPS
133+
// Step 7: Configure Nginx for HTTPS
131134
nostr_rs_relay.ConfigureNginxHttps(relayDomain)
132135
}
133136

134-
// Step 7: Download and install the relay binary
137+
// Step 8: Download and install the relay binary
135138
nostr_rs_relay.InstallRelayBinary()
136139

137-
// Step 8: Set up the relay service
140+
// Step 9: Set up the relay service
138141
nostr_rs_relay.SetupRelayService(relayDomain, pubKey, relayContact, httpsEnabled)
139142

140-
// Step 9: Show success messages
143+
// Step 10: Show success messages
141144
nostr_rs_relay.SuccessMessages(relayDomain, httpsEnabled)
142145
} else if selectedRelayOption == strfry.RelayName {
143-
// Step 4: Configure Nginx for HTTP
146+
// Step 5: Configure Nginx for HTTP
144147
strfry.ConfigureNginxHttp(relayDomain)
145148

146-
// Step 5: Get SSL/TLS certificates
149+
// Step 6: Get SSL/TLS certificates
147150
httpsEnabled := network.GetCertificates(relayDomain)
148151
if httpsEnabled {
149-
// Step 6: Configure Nginx for HTTPS
152+
// Step 7: Configure Nginx for HTTPS
150153
strfry.ConfigureNginxHttps(relayDomain)
151154
}
152155

153-
// Step 7: Download and install the relay binary
156+
// Step 8: Download and install the relay binary
154157
strfry.InstallRelayBinary()
155158

156-
// Step 8: Set up the relay service
159+
// Step 9: Set up the relay service
157160
strfry.SetupRelayService(relayDomain, relayContact)
158161

159-
// Step 9: Show success messages
162+
// Step 10: Show success messages
160163
strfry.SuccessMessages(relayDomain, httpsEnabled)
161164
} else if selectedRelayOption == wot_relay.RelayName {
162-
// Step 4: Configure Nginx for HTTP
165+
// Step 5: Configure Nginx for HTTP
163166
wot_relay.ConfigureNginxHttp(relayDomain)
164167

165-
// Step 5: Get SSL/TLS certificates
168+
// Step 6: Get SSL/TLS certificates
166169
httpsEnabled := network.GetCertificates(relayDomain)
167170
if httpsEnabled {
168-
// Step 6: Configure Nginx for HTTPS
171+
// Step 7: Configure Nginx for HTTPS
169172
wot_relay.ConfigureNginxHttps(relayDomain)
170173
}
171174

172-
// Step 7: Download and install the relay binary
175+
// Step 8: Download and install the relay binary
173176
wot_relay.InstallRelayBinary()
174177

175-
// Step 8: Set up the relay service
178+
// Step 9: Set up the relay service
176179
wot_relay.SetupRelayService(relayDomain, pubKey, relayContact, httpsEnabled)
177180

178-
// Step 9: Show success messages
181+
// Step 10: Show success messages
179182
wot_relay.SuccessMessages(relayDomain, httpsEnabled)
180183
} else if selectedRelayOption == khatru29.RelayName {
181-
// Step 4: Configure Nginx for HTTP
184+
// Step 5: Configure Nginx for HTTP
182185
khatru29.ConfigureNginxHttp(relayDomain)
183186

184-
// Step 5: Get SSL/TLS certificates
187+
// Step 6: Get SSL/TLS certificates
185188
httpsEnabled := network.GetCertificates(relayDomain)
186189
if httpsEnabled {
187-
// Step 6: Configure Nginx for HTTPS
190+
// Step 7: Configure Nginx for HTTPS
188191
khatru29.ConfigureNginxHttps(relayDomain)
189192
}
190193

191-
// Step 7: Download and install the relay binary
194+
// Step 8: Download and install the relay binary
192195
khatru29.InstallRelayBinary()
193196

194-
// Step 8: Set up the relay service
197+
// Step 9: Set up the relay service
195198
khatru29.SetupRelayService(relayDomain, privKey, relayContact)
196199

197-
// Step 9: Show success messages
200+
// Step 10: Show success messages
198201
khatru29.SuccessMessages(relayDomain, httpsEnabled)
199202
} else if selectedRelayOption == strfry29.RelayName {
200-
// Step 4: Configure Nginx for HTTP
203+
// Step 5: Configure Nginx for HTTP
201204
strfry29.ConfigureNginxHttp(relayDomain)
202205

203-
// Step 5: Get SSL/TLS certificates
206+
// Step 6: Get SSL/TLS certificates
204207
httpsEnabled := network.GetCertificates(relayDomain)
205208
if httpsEnabled {
206-
// Step 6: Configure Nginx for HTTPS
209+
// Step 7: Configure Nginx for HTTPS
207210
strfry29.ConfigureNginxHttps(relayDomain)
208211
}
209212

210-
// Step 7: Download and install the relay binary
213+
// Step 8: Download and install the relay binary
211214
strfry29.InstallRelayBinary()
212215

213-
// Step 8: Set up the relay service
216+
// Step 9: Set up the relay service
214217
strfry29.SetupRelayService(relayDomain, privKey, relayContact)
215218

216-
// Step 9: Show success messages
219+
// Step 10: Show success messages
217220
strfry29.SuccessMessages(relayDomain, httpsEnabled)
218221
}
219222

‎pkg/network/constants.go

+10
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
package network
22

3+
const SSHJailFilePath = "/etc/fail2ban/jail.d/sshd.local"
4+
const SSHJailFileTemplate = `[sshd]
5+
enabled = true
6+
port = 22
7+
findtime = 5m
8+
bantime = 2h
9+
maxentry = 3
10+
ignoreip = 127.0.0.1/8 ::1
11+
backend = systemd
12+
`
313
const CertificateDirPath = "/etc/letsencrypt/live"
414
const FullchainFile = "fullchain.pem"
515
const PrivkeyFile = "privkey.pem"

‎pkg/network/intrusion_detection.go

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
package network
2+
3+
import (
4+
"fmt"
5+
"github.com/nodetec/rwz/pkg/utils/files"
6+
"github.com/nodetec/rwz/pkg/utils/network"
7+
"github.com/pterm/pterm"
8+
"os"
9+
"os/exec"
10+
)
11+
12+
// Function to configure the intrusion detection system
13+
func ConfigureIntrusionDetection() {
14+
spinner, _ := pterm.DefaultSpinner.Start("Configuring intrusion detection system...")
15+
16+
// Check if the SSH jail file exists and remove it if it does
17+
files.RemoveFile(SSHJailFilePath)
18+
19+
// Create the SSH jail file
20+
spinner.UpdateText("Creating SSH jail file...")
21+
network.CreateJailFile(SSHJailFilePath, SSHJailFileTemplate)
22+
23+
// Restart the intrusion detection system to apply the changes
24+
err := exec.Command("systemctl", "restart", "fail2ban").Run()
25+
if err != nil {
26+
pterm.Println()
27+
pterm.Error.Println(fmt.Sprintf("Failed to restart intrusion detection system: %v", err))
28+
os.Exit(1)
29+
}
30+
31+
spinner.Success("Intrusion detection system configured successfully.")
32+
}

‎pkg/utils/network/utils.go

+32
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
package network
22

3+
import (
4+
"fmt"
5+
"github.com/pterm/pterm"
6+
"os"
7+
"text/template"
8+
)
9+
310
// Function to determine http scheme being used
411
func HTTPEnabled(httpsEnabled bool) string {
512
if httpsEnabled {
@@ -15,3 +22,28 @@ func WSEnabled(httpsEnabled bool) string {
1522
}
1623
return "ws"
1724
}
25+
26+
// Function to create jail files for the intrusion detection system
27+
func CreateJailFile(jailFilePath, jailTemplate string) {
28+
jailFile, err := os.Create(jailFilePath)
29+
if err != nil {
30+
pterm.Println()
31+
pterm.Error.Println(fmt.Sprintf("Failed to create jail file: %v", err))
32+
os.Exit(1)
33+
}
34+
defer jailFile.Close()
35+
36+
jailTmpl, err := template.New("jail").Parse(jailTemplate)
37+
if err != nil {
38+
pterm.Println()
39+
pterm.Error.Println(fmt.Sprintf("Failed to parse jail template: %v", err))
40+
os.Exit(1)
41+
}
42+
43+
err = jailTmpl.Execute(jailFile, struct{}{})
44+
if err != nil {
45+
pterm.Println()
46+
pterm.Error.Println(fmt.Sprintf("Failed to execute jail template: %v", err))
47+
os.Exit(1)
48+
}
49+
}

0 commit comments

Comments
 (0)