#!/bin/bash
######系統配合
#下載ISO檔
#https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝
######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw
####安裝 fail2ban
DOMAINNAME=$(/bin/hostname -d)
DATE=$(date "+%Y%m%d%H")
. /root/setup.txt
sync
apt install -y fail2ban
# wget https://launchpad.net/ubuntu/+source/fail2ban/1.1.0-1/+build/28291332/+files/fail2ban_1.1.0-1_all.deb
# dpkg -i ./fail2ban_1.1.0-1_all.deb
cp -arf /etc/fail2ban/jail.conf  /etc/fail2ban/jail.conf-$DATE
cat > /etc/fail2ban/jail.conf << EOF
[DEFAULT]
ignoreip = 127.0.0.1/8
bantime  = -1
findtime = 600
maxretry = 3
backend  = systemd

[sshd]
enabled  = true
filter   = sshd
action   = iptables[name=SSHD, port=ssh, protocol=tcp]
        sendmail-whois[name=SSHD, dest=$Email, sender=root@$DOMAINNAME]
logpath  = /var/log/auth.log
maxretry = 3

[vsftpd]
enabled  = true
filter   = vsftpd
action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
        sendmail-whois[name=VSFTPD, dest=$Email, sender=root@$DOMAINNAME]
logpath  = /var/log/auth.log
maxretry = 3

[proftpd]
enabled  = true
filter   = proftpd
action   = iptables[name=PROFTPD, port="ftp,ftp-data,ftps,ftps-data", protocol=tcp]
        sendmail-whois[name=PROFTPD, dest=$Email, sender=root@$DOMAINNAME]
logpath  = /var/log/auth.log
maxretry = 3

[dovecot]
enabled  = true
filter   = dovecot
action   = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps,smtp,smtps,submission,sieve", protocol=tcp]
        sendmail-whois[name=dovecot, dest=$Email, sender=root@$DOMAINNAME]
logpath  = /var/log/auth.log
maxretry = 10

[dovecot-auth]
enabled = true
filter = dovecot
action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps,smtps,submission,sieve", protocol=tcp]
        sendmail-whois[name=dovecot, dest=$Email, sender=root@$DOMAINNAME]
logpath = /var/log/auth.log
maxretry = 10
EOF
systemctl enable fail2ban.service
systemctl restart fail2ban.service