Altair-sh
59 lines
1.6 KiB
Markdown
59 lines
1.6 KiB
Markdown
# Caddy + fail2ban
|
|
|
|
## Caddy
|
|
Modern http proxy server with easy configuration.
|
|
|
|
Rebuild caddy with transform-encoder (used to format logs that fail2ban reads):
|
|
```sh
|
|
go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
|
|
~/go/bin/xcaddy build --with github.com/caddyserver/transform-encoder
|
|
sudo mv caddy /usr/bin/caddy
|
|
sudo systemctl restart caddy
|
|
caddy list-modules | grep transform
|
|
sudo apt-mark hold caddy
|
|
rm -rf ~/go
|
|
```
|
|
|
|
Add to `/etc/caddy/Caddyfile`:
|
|
```Caddyfile
|
|
files.example.com { # your url
|
|
request_body {
|
|
max_size 4GB
|
|
}
|
|
reverse_proxy 127.0.0.1:8080 { # serveg address
|
|
transport http {
|
|
versions 1.1
|
|
}
|
|
}
|
|
# log response status and request authorization for fail2ban
|
|
log {
|
|
output file /var/log/caddy/files-auth.log
|
|
format transform "{ts} {request>client_ip} {status} {request>headers>Authorization>[0]}" {
|
|
time_format iso8601
|
|
placeholder -
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
Restart caddy:
|
|
```sh
|
|
sudo systemctl restart caddy
|
|
```
|
|
|
|
### Fail2ban
|
|
Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
|
|
|
|
1. Copy [delpoy/caddy-auth.conf](./delpoy/caddy-auth.conf) to `/etc/fail2ban/filter.d/caddy-auth.conf`
|
|
2. Copy [delpoy/caddy-auth.local](./delpoy/caddy-auth.local) to `/etc/fail2ban/jail.d/caddy-auth.local`
|
|
3. Reload fail2ban:
|
|
```sh
|
|
sudo fail2ban-client reload
|
|
```
|
|
4. Test fail2ban:
|
|
```sh
|
|
curl -s -o /dev/null -u wrong:wrong https://files.example.com/private
|
|
curl -s -o /dev/null https://files.example.com/private
|
|
sudo fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
|
|
```
|