Altair-sh
73 lines
1.8 KiB
Markdown
73 lines
1.8 KiB
Markdown
# Caddy + fail2ban
|
|
|
|
## Caddy
|
|
Modern http proxy server with easy configuration.
|
|
|
|
Install log formatter plugin:
|
|
```sh
|
|
caddy add-package github.com/caddyserver/transform-encoder
|
|
```
|
|
|
|
Add to `/etc/caddy/Caddyfile`:
|
|
```Caddyfile
|
|
files.example.com { # your url
|
|
request_body {
|
|
max_size 4GB
|
|
}
|
|
reverse_proxy 127.0.0.1:8080 { # serveg address
|
|
transport http {
|
|
versions 1.1
|
|
}
|
|
}
|
|
# log response status and request authorization for fail2ban
|
|
log {
|
|
output file /var/log/caddy/files-auth.log
|
|
format transform "{ts} {request>client_ip} {status} {request>headers>Authorization>[0]}" {
|
|
time_format iso8601
|
|
placeholder -
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
Restart caddy:
|
|
```sh
|
|
sudo systemctl restart caddy
|
|
```
|
|
|
|
### Fail2ban
|
|
Service that reads logs from various sources, finds password trials and bans ip if it tries to brute force password.
|
|
|
|
Write to `/etc/fail2ban/filter.d/caddy-auth.conf`
|
|
```conf
|
|
[Definition]
|
|
failregex = <ADDR> 401 REDACTED$
|
|
ignoreregex =
|
|
```
|
|
|
|
Write to `/etc/fail2ban/jail.d/caddy-auth.local`
|
|
```conf
|
|
[caddy-auth]
|
|
enabled = true
|
|
filter = caddy-auth # /etc/fail2ban/filter.d/caddy-auth.conf
|
|
logpath = /var/log/caddy/files-auth.log
|
|
backend = auto # without it on debian fail2ban will use systemd logging and to read caddy log
|
|
maxretry = 10 # N wrong passwords
|
|
findtime = 10m # sent during 10 minutes
|
|
bantime = 1h # ban for 1 hour
|
|
banaction = iptables-allports # ban the ip for all ports
|
|
protocol = all # and all protocols
|
|
ignoreip = 127.0.0.1/8 ::1 # ignore localhost
|
|
```
|
|
Reload fail2ban:
|
|
```sh
|
|
sudo fail2ban-client reload
|
|
```
|
|
|
|
Test fail2ban:
|
|
```sh
|
|
curl -s -o /dev/null -u wrong:wrong https://files.example.com/
|
|
curl -s -o /dev/null https://files.example.com/
|
|
fail2ban-regex /var/log/caddy/files-auth.log /etc/fail2ban/filter.d/caddy-auth.conf
|
|
```
|