lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update sample for fail2ban

Browse Source
This commit is contained in:
Laurent Destailleur 2022-10-18 12:59:15 +02:00
parent 4cf021aeeb
commit 938bc27917
5 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dev/setup/fail2ban/filter.d/web-dolibarr-limitpublic.conf
View File

@ -1,8 +1,7 @@
# Fail2Ban configuration file # Fail2Ban configuration file
# #
# Regexp to catch known spambots and software alike. Please verify # Regexp to detect access on public pages so we can add mitigation on IP making too much
# that it is your intent to block IPs which were driven by # access to your a Dolibarr instance.
# above mentioned bots.
[Definition] [Definition]
@ -11,7 +10,7 @@
# echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 --- Access to GET /public/clicktodial/cidlookup.php" >> /mypath/documents/dolibarr.log # echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 --- Access to GET /public/clicktodial/cidlookup.php" >> /mypath/documents/dolibarr.log
# #
# then # then
# fail2ban-client status web-dol-passforgotten # fail2ban-client status web-dolibarr-limitpublic
# #
# To test rule file on a existing log file # To test rule file on a existing log file
# fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-limitpublic.conf # fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-limitpublic.conf

7
dev/setup/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf
View File

@ -1,8 +1,7 @@
# Fail2Ban configuration file # Fail2Ban configuration file
# #
# Regexp to catch known spambots and software alike. Please verify # Regexp to detect try to check a couple login/password so we can add mitigation
# that it is your intent to block IPs which were driven by # on IP making too much tries.
# above mentioned bots.
[Definition] [Definition]
@ -11,7 +10,7 @@
# echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 functions_dolibarr::check_user_password_abcd Authentication KO" >> /mypath/documents/dolibarr.log # echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 functions_dolibarr::check_user_password_abcd Authentication KO" >> /mypath/documents/dolibarr.log
# #
# then # then
# fail2ban-client status web-dol-bruteforce # fail2ban-client status web-dolibarr-rulesbruteforce
# #
# To test rule file on a existing log file # To test rule file on a existing log file
# fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf # fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulesbruteforce.conf

7
dev/setup/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf
View File

@ -1,8 +1,7 @@
# Fail2Ban configuration file # Fail2Ban configuration file
# #
# Regexp to catch known spambots and software alike. Please verify # Regexp to detect access on passwordforgotten.php page so we can add mitigation on IP making too much
# that it is your intent to block IPs which were driven by # access to this Dolibarr page.
# above mentioned bots.
[Definition] [Definition]
@ -11,7 +10,7 @@
# echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 --- Access to GET /passwordforgotten.php - action=buildnewpassword, massaction=" >> /mypath/documents/dolibarr.log # echo `date +'%Y-%m-%d %H:%M:%S'`" INFO 1.2.3.4 --- Access to GET /passwordforgotten.php - action=buildnewpassword, massaction=" >> /mypath/documents/dolibarr.log
# #
# then # then
# fail2ban-client status web-dol-passforgotten # fail2ban-client status web-dolibarr-rulespassforgotten
# #
# To test rule file on a existing log file # To test rule file on a existing log file
# fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf # fail2ban-regex /mypath/documents/dolibarr.log /etc/fail2ban/filter.d/web-dolibarr-rulespassforgotten.conf

7
htdocs/admin/system/security.php
View File

@ -570,9 +570,10 @@ print 'For a higher security, we also recommend to implement limits and mitigati
print '</span>'; print '</span>';
print '<br>'; print '<br>';
print 'Login process -> This can be done using a fail2ban rule (see example into dev/setup)'."<br>"; $urlexamplebase = 'https://github.com/Dolibarr/dolibarr/blob/develop/dev/setup/fail2ban/filter.d/';
print DOL_URL_ROOT.'/passwordforgotten.php (see example into dev/setup)'."<br>"; print '- Login process (see fail2ban example on <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulesbruteforce.conf">GitHub</a>)<br>';
print DOL_URL_ROOT.'/public/* (see example into dev/setup)'."<br>"; print '- '.DOL_URL_ROOT.'/passwordforgotten.php (see fail2ban example on <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-rulespassgorgotten.conf">GitHub</a>)<br>';
print '- '.DOL_URL_ROOT.'/public/* (see fail2ban example on <a target="_blank" rel="noopener" href="'.$urlexamplebase.'web-dolibarr-limitpublic.conf">GitHub</a>)<br>';

4
htdocs/langs/en_US/admin.lang
View File

@ -2329,4 +2329,6 @@ HelpCssOnViewDesc=The Css used when viewing the field.
HelpCssOnListDesc=The Css used when field is inside a list table.<br>Example: "tdoverflowmax200" HelpCssOnListDesc=The Css used when field is inside a list table.<br>Example: "tdoverflowmax200"
RECEPTION_PDF_HIDE_ORDERED=Hide the quantity ordered on the generated documents for receptions RECEPTION_PDF_HIDE_ORDERED=Hide the quantity ordered on the generated documents for receptions
MAIN_PDF_RECEPTION_DISPLAY_AMOUNT_HT=Show the price on the generated documents for receptions MAIN_PDF_RECEPTION_DISPLAY_AMOUNT_HT=Show the price on the generated documents for receptions
WarningDisabled=Warning disabled WarningDisabled=Warning disabled
LimitsAndMitigation=Access limits and mitigation