diff --git a/config/letsencrypt/crontabs/root b/config/letsencrypt/crontabs/root new file mode 100644 index 0000000..c24fea0 --- /dev/null +++ b/config/letsencrypt/crontabs/root @@ -0,0 +1,9 @@ +# do daily/weekly/monthly maintenance +# min hour day month weekday command +*/15 * * * * run-parts /etc/periodic/15min +0 * * * * run-parts /etc/periodic/hourly +0 2 * * * run-parts /etc/periodic/daily +0 3 * * 6 run-parts /etc/periodic/weekly +0 5 1 * * run-parts /etc/periodic/monthly +# renew letsencrypt certs +8 2 * * * /app/le-renew.sh >> /config/log/letsencrypt/letsencrypt.log 2>&1 diff --git a/config/letsencrypt/dns-conf/aliyun.ini b/config/letsencrypt/dns-conf/aliyun.ini new file mode 100644 index 0000000..d8a648f --- /dev/null +++ b/config/letsencrypt/dns-conf/aliyun.ini @@ -0,0 +1,6 @@ +# Obtain Aliyun RAM AccessKey +# https://ram.console.aliyun.com/ +# And ensure your RAM account has AliyunDNSFullAccess permission. + +certbot_dns_aliyun:dns_aliyun_access_key = 12345678 +certbot_dns_aliyun:dns_aliyun_access_key_secret = 1234567890abcdef1234567890abcdef diff --git a/config/letsencrypt/dns-conf/cloudflare.ini b/config/letsencrypt/dns-conf/cloudflare.ini new file mode 100644 index 0000000..491aebf --- /dev/null +++ b/config/letsencrypt/dns-conf/cloudflare.ini @@ -0,0 +1,4 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-cloudflare/certbot_dns_cloudflare/__init__.py#L20 +# Replace with your values +dns_cloudflare_email = cloudflare@example.com +dns_cloudflare_api_key = 0123456789abcdef0123456789abcdef01234567 diff --git a/config/letsencrypt/dns-conf/cloudxns.ini b/config/letsencrypt/dns-conf/cloudxns.ini new file mode 100644 index 0000000..a86f7d7 --- /dev/null +++ b/config/letsencrypt/dns-conf/cloudxns.ini @@ -0,0 +1,4 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-cloudxns/certbot_dns_cloudxns/__init__.py#L20 +# Replace with your values +dns_cloudxns_api_key = 1234567890abcdef1234567890abcdef +dns_cloudxns_secret_key = 1122334455667788 diff --git a/config/letsencrypt/dns-conf/cpanel.ini b/config/letsencrypt/dns-conf/cpanel.ini new file mode 100644 index 0000000..28b6953 --- /dev/null +++ b/config/letsencrypt/dns-conf/cpanel.ini @@ -0,0 +1,6 @@ +# Instructions: https://github.com/badjware/certbot-dns-cpanel#credentials +# Replace with your values +# include the scheme and the port number (usually 2083 for https) +certbot_dns_cpanel:cpanel_url = https://cpanel.example.com:2083 +certbot_dns_cpanel:cpanel_username = username +certbot_dns_cpanel:cpanel_password = 1234567890abcdef \ No newline at end of file diff --git a/config/letsencrypt/dns-conf/digitalocean.ini b/config/letsencrypt/dns-conf/digitalocean.ini new file mode 100644 index 0000000..eff7677 --- /dev/null +++ b/config/letsencrypt/dns-conf/digitalocean.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-digitalocean/certbot_dns_digitalocean/__init__.py#L21 +# Replace with your value +dns_digitalocean_token = 0000111122223333444455556666777788889999aaaabbbbccccddddeeeeffff diff --git a/config/letsencrypt/dns-conf/dnsimple.ini b/config/letsencrypt/dns-conf/dnsimple.ini new file mode 100644 index 0000000..8eedb63 --- /dev/null +++ b/config/letsencrypt/dns-conf/dnsimple.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-dnsimple/certbot_dns_dnsimple/__init__.py#L20 +# Replace with your value +dns_dnsimple_token = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw diff --git a/config/letsencrypt/dns-conf/dnsmadeeasy.ini b/config/letsencrypt/dns-conf/dnsmadeeasy.ini new file mode 100644 index 0000000..942c403 --- /dev/null +++ b/config/letsencrypt/dns-conf/dnsmadeeasy.ini @@ -0,0 +1,4 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-dnsmadeeasy/certbot_dns_dnsmadeeasy/__init__.py#L20 +# Replace with your values +dns_dnsmadeeasy_api_key = 1c1a3c91-4770-4ce7-96f4-54c0eb0e457a +dns_dnsmadeeasy_secret_key = c9b5625f-9834-4ff8-baba-4ed5f32cae55 diff --git a/config/letsencrypt/dns-conf/domeneshop.ini b/config/letsencrypt/dns-conf/domeneshop.ini new file mode 100644 index 0000000..e213287 --- /dev/null +++ b/config/letsencrypt/dns-conf/domeneshop.ini @@ -0,0 +1,4 @@ +# Instructions: https://github.com/domeneshop/certbot-dns-domeneshop#credentials +# Replace with your values +certbot_dns_domeneshop:dns_domeneshop_client_token=1234567890abcdef +certbot_dns_domeneshop:dns_domeneshop_client_secret=1234567890abcdefghijklmnopqrstuvxyz1234567890abcdefghijklmnopqrs \ No newline at end of file diff --git a/config/letsencrypt/dns-conf/gandi.ini b/config/letsencrypt/dns-conf/gandi.ini new file mode 100644 index 0000000..a5c04b3 --- /dev/null +++ b/config/letsencrypt/dns-conf/gandi.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/obynio/certbot-plugin-gandi#usage +# Replace with your value +certbot_plugin_gandi:dns_api_key=APIKEY diff --git a/config/letsencrypt/dns-conf/google.json b/config/letsencrypt/dns-conf/google.json new file mode 100644 index 0000000..c5a59cf --- /dev/null +++ b/config/letsencrypt/dns-conf/google.json @@ -0,0 +1,6 @@ +{ + "instructions": "https://github.com/certbot/certbot/blob/master/certbot-dns-google/certbot_dns_google/__init__.py", + "_comment": "Replace with your values", + "type": "service_account", + "rest": "..." +} \ No newline at end of file diff --git a/config/letsencrypt/dns-conf/inwx.ini b/config/letsencrypt/dns-conf/inwx.ini new file mode 100644 index 0000000..3479d23 --- /dev/null +++ b/config/letsencrypt/dns-conf/inwx.ini @@ -0,0 +1,6 @@ +# Instructions: https://github.com/oGGy990/certbot-dns-inwx +# Replace with your values +certbot_dns_inwx:dns_inwx_url = https://api.domrobot.com/xmlrpc/ +certbot_dns_inwx:dns_inwx_username = your_username +certbot_dns_inwx:dns_inwx_password = your_password +certbot_dns_inwx:dns_inwx_shared_secret = your_shared_secret optional diff --git a/config/letsencrypt/dns-conf/linode.ini b/config/letsencrypt/dns-conf/linode.ini new file mode 100644 index 0000000..2d434a1 --- /dev/null +++ b/config/letsencrypt/dns-conf/linode.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-linode/certbot_dns_linode/__init__.py#L25 +# Replace with your values +dns_linode_key = 0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ64 diff --git a/config/letsencrypt/dns-conf/luadns.ini b/config/letsencrypt/dns-conf/luadns.ini new file mode 100644 index 0000000..01de1dd --- /dev/null +++ b/config/letsencrypt/dns-conf/luadns.ini @@ -0,0 +1,4 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-luadns/certbot_dns_luadns/__init__.py#L20 +# Replace with your values +dns_luadns_email = user@example.com +dns_luadns_token = 0123456789abcdef0123456789abcdef diff --git a/config/letsencrypt/dns-conf/nsone.ini b/config/letsencrypt/dns-conf/nsone.ini new file mode 100644 index 0000000..f1858ca --- /dev/null +++ b/config/letsencrypt/dns-conf/nsone.ini @@ -0,0 +1,3 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-nsone/certbot_dns_nsone/__init__.py#L20 +# Replace with your value +dns_nsone_api_key = MDAwMDAwMDAwMDAwMDAw diff --git a/config/letsencrypt/dns-conf/ovh.ini b/config/letsencrypt/dns-conf/ovh.ini new file mode 100644 index 0000000..f8fef57 --- /dev/null +++ b/config/letsencrypt/dns-conf/ovh.ini @@ -0,0 +1,6 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-ovh/certbot_dns_ovh/__init__.py#L20 +# Replace with your values +dns_ovh_endpoint = ovh-eu +dns_ovh_application_key = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw +dns_ovh_application_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw +dns_ovh_consumer_key = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw diff --git a/config/letsencrypt/dns-conf/rfc2136.ini b/config/letsencrypt/dns-conf/rfc2136.ini new file mode 100644 index 0000000..75b6c7a --- /dev/null +++ b/config/letsencrypt/dns-conf/rfc2136.ini @@ -0,0 +1,11 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-rfc2136/certbot_dns_rfc2136/__init__.py#L20 +# Replace with your values +# Target DNS server +dns_rfc2136_server = 192.0.2.1 +# TSIG key name +dns_rfc2136_name = keyname. +# TSIG key secret +dns_rfc2136_secret = 4q4wM/2I180UXoMyN4INVhJNi8V9BCV+jMw2mXgZw/CSuxUT8C7NKKFs \ +AmKd7ak51vWKgSl12ib86oQRPkpDjg== +# TSIG key algorithm +dns_rfc2136_algorithm = HMAC-SHA512 diff --git a/config/letsencrypt/dns-conf/route53.ini b/config/letsencrypt/dns-conf/route53.ini new file mode 100644 index 0000000..18ce326 --- /dev/null +++ b/config/letsencrypt/dns-conf/route53.ini @@ -0,0 +1,5 @@ +# Instructions: https://github.com/certbot/certbot/blob/master/certbot-dns-route53/certbot_dns_route53/__init__.py#L18 +# Replace with your values +[default] +aws_access_key_id=AKIAIOSFODNN7EXAMPLE +aws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY diff --git a/config/letsencrypt/dns-conf/transip.ini b/config/letsencrypt/dns-conf/transip.ini new file mode 100644 index 0000000..f5ec586 --- /dev/null +++ b/config/letsencrypt/dns-conf/transip.ini @@ -0,0 +1,6 @@ +# Instructions: https://readthedocs.org/projects/certbot-dns-transip/ +# Convert the key to an RSA key (openssl rsa -in transip.key -out transip-rsa.key) +# Place .key-file in the same directory as this file. Location "/config/dns-conf" is from within the container + +certbot_dns_transip:dns_transip_username = +certbot_dns_transip:dns_transip_key_file = /config/dns-conf/transip-rsa.key \ No newline at end of file diff --git a/config/letsencrypt/donoteditthisfile.conf b/config/letsencrypt/donoteditthisfile.conf new file mode 100644 index 0000000..dfa621d --- /dev/null +++ b/config/letsencrypt/donoteditthisfile.conf @@ -0,0 +1 @@ +ORIGURL="villafleuriegp.com" ORIGSUBDOMAINS="" ORIGONLY_SUBDOMAINS="false" ORIGEXTRA_DOMAINS="" ORIGDHLEVEL="2048" ORIGVALIDATION="http" ORIGDNSPLUGIN="" ORIGSTAGING="" ORIGDUCKDNSTOKEN="" diff --git a/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/meta.json b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/meta.json new file mode 100644 index 0000000..2b9aac8 --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/meta.json @@ -0,0 +1 @@ +{"creation_dt": "2020-03-31T19:58:01Z", "creation_host": "a6d0f8b70c72"} \ No newline at end of file diff --git a/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/private_key.json b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/private_key.json new file mode 100644 index 0000000..367eb3e --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/private_key.json @@ -0,0 +1 @@ +{"n": "vkNWLphEzrpFByVtURAIZDckjRjMnCl3Rs2VAlKjRK40kcDEL6Xsv1ypS8sIn4xYEOCuo20xPJ0jlNuUFiTd0IouBMhKTpfLB0Br8Umcpfu8xGEsBmy9IDlg9ujChaD0Yj-GW1PI48qVnuBX-vtqzqMyygYSHfo8pvEYkobYVLklfhmnQiIS_7TszRo6N_Sibfo_RAGOIorvSnab5-Q4Uh5qXhcAG3JEKFpDpcTGThquUN5NefKSnXiUJaZBKBSl--GRAvOZTjOLGl-uBTu4lmN0uKqtQjgomkxS9BhkrGKgAYEuw8-rwOi_4sP9GEe1aVFNjwIiGKAhYYL7CSzA6r5OccQsXSVIqyOk2ZCqoqGYJlM56OzC2mX1mZ4Bld0MPHMHxiitpOta1yxCO9ZNY4XM7vVTrRgXfP5I4u_lD5IS0_rC-1Fizj-3kxO-4kl28Vu588vDW0y1LoWb6-nuGMNfNcPOWjEZ93EIQqJoJnHtupCPcmhzS_a4tke0_rAW5wnYV78XvNgGnOyNrQMbXtidCTYIdZkJqrcaGKecS_EPgZcFbQellDodzzRef_kvIloKu8oOXUzd0VOa6FvS0YTd4pwGiomJcc5Z8vRBcoDtX0d3-PuqnFyai2xatHT9kFCrqyiF52FLCINrTqTO8cZbEb73FxdCfck_zakgXlc", "e": "AQAB", "d": "QAsSe2St5Jg2nA0xGtQ2vuUA3K24UehzSdXxjnKamoe5Eka8wv0rD870_Zo-MNZg3m2C22fp5ulODNFMq5eFQqkAjIOO352grbQ1oWaR4B04kTHUS-VWU_58cSAwOiLPoDKZ2yv8txB-BJinhMgUT7IHapFYj9ani9oj106kiwA3apbgAhbOJlyUSQXHCwbBlhtiKFYNrfruSTZbjFb5zkqGq106oAJ6hsq7cpUl2yyH-Jibo6zPRUpNM88ep4srw_lNgpzUwcn_zMTgIsrTe2vG4lIxN9UHdcizM47ydEROb7M4Npk0yx6NWJt4GjApFGZVoQmqyHc-RUB9l70EwmnJsqMAHBSulr3QY4ZMraisgxjfVUGARp7E2fsO9DfmjS4iHBYQqoZRJNA8vK21xvzaibgPlT_9F16nWsHCiGdgZKH-1EtLU_9JDSc9cO7mHY6kq1MecQOqYs-t7DVF8XXag9P_DcBJPafkklAxW3eXyMF3MlwQ4H-7yPDI081O3UdwvJIKkl-XB5bolm3XQA6ejbTKUw7FK9Pwos5Jsq6erGvF-nN95ROCss_U0Ym0yEpNG_2vriakwqQRG98yfNzcvm8i9HM7zCskXclK5-3JhOxwDM3I94voI4fYqJz9N2bQY64Ppfy18QFZSkbzEiKmDIRZxw0BZcpRs-2SXiE", "p": "-fTW2Bhph26d9Mn-J-7t7qIBf3FzrpLzpF884ttD_JHa1a-EM4JntKNtUvbDC4bX4e2lA4dvhRinvJRnqLfKQ66P41Y-oRzD_W5vtfe1Wa_dYrQTQcBeuEpUrRgrkqEPSFsS-3__FSqPhHdTUn6Rs5ZRmml3fJv_jRvKBP4NRkuuLZhigUC1-BgLf8EKzCw39P4EHYRRx5PqMZwtPdjrk45PC3TIQdNKIWd6N73g69eJ-jDPURG-xp47_fgRhuRzaKJ16vwNDLUvXD_yraBI8_ImlzztHppd4DRa-DTu_3GaD4kfMMWF07VL2SEtcy_R2tNHWAcPS7VfO_utyp8X7Q", "q": "wt0DE_deRygifA8_mKKX_xwSGrqxfCN1sOH4SBznuvCBN8ndgVhZ9XSUlaUA0T7mxrcPbTXf5-ovIGQdOHJ0xULYI9MoK4Uhq40u3_Pr2nuAuSvTLEWA2Vs5uSCCVbKdvqYSXhD4SoFHI6O1dyPjFmgd40Gl2BNPv2RIuGmOVKRurfJkVgi8lFiBY1Pt2WF1o-d52MhgnTxw5nSanELU05QZ3k1Pe_cL7OU8B9GTyhnJ3hglEjghTkelMz4caPrahTaDKODbdd0KJuWVWqDG2y4oa0mPoBhONjevIYUQXC5IvYo3sGnbEs7P7_AI9d1n_RMacmBe-946IL6k6f1-0w", "dp": "PeG4wt0gWzAumOjdLEPB0h93oXaT_jdRbHNLnppMNZ5igB6o6xuw0w7WxQBkf1kN31g3Ty1blabp-A0BsMp3n9P6uXyjmr2FZBvQOkuuMRsSAxqz3cZjbNqyJfxi5TVMlEw_4dXpb_MOfuwPy8-cAMsJPuI3e7kfRm8Hz76ZyLp5z733PSqpIlfJmQJQywVzgQrWN_yHRpK_GzMgHDy07d4AgcSSw4EszCJTJrOymJDPDwrAeMCc641HKvQcWrn6PIBkEx39mRTOOdd3HDcfeI2NskmaJsZu0VAE6YgpV0Jnssru1uM_447xzTqihu7i1HsUIZ310nd_sVj4yL4kbQ", "dq": "n8o2VPAbCkSaCptCbjqeY160ZeDD2-UEBFk4jIHPcFb5zzKkhgVaN1Iy6YdV5UAsY7UHXGm6QuWhYXFXGMuaf4uxy6bCoPVZx-BNGO5fcFioFLAgSYRxBUuuSOWkmvuOKSDrnOFTiVz7Zfk_vAPcmqokIA_cHBSx52Mn0rkUMspnzBIhPv-JDCiLaVUQjJpDqnUNULv3pdhDSGdDxXF0Lk-a6tUAocnSqJ7NnCe6hhahl5K7C3alsRhFGoELMPbLrEMoSKQiskLgqUbIM3n1txPhpyC6OvDTadg9r0H7SWvW0D6ALhSPxZt7neh6oIq_VCKPJE1sdiMkDWfnuczaaw", "qi": "QnwRXqSA2mQXpDo-S-k4z82Hsk_vSI2itr_Qvirspd4OGnyZjdkaB0vVNT6SzAGnTWmCk3_F_LIrEWpIK9V1V7b5MqivTWWhO9P1rhhR4x-rVUSHkn3mhZMQGHlIeFSiQG43VndokDVMec9srLg77uaSfsr8u57obZVQnJtaTMr6YZo14qADH8Zp0dPK_JaKZZWedkLA7nfQKOzqwesj7W6qzp_1-gYOUn-vGzoanljqM8DUSSqoGo3SgnPBBfPp76szbo4v7N7frHhZNhZrfRMuJKqeg-AZZxXq1Q6uZjSqydWHSUwVBXydHXueAHjUjBgYVyx_EL19EWir9C9CcQ", "kty": "RSA"} \ No newline at end of file diff --git a/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/regr.json b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/regr.json new file mode 100644 index 0000000..59e779b --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/de0e78c51e87fad5939c305b012df7e6/regr.json @@ -0,0 +1 @@ +{"body": {}, "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/82129720"} \ No newline at end of file diff --git a/config/letsencrypt/etc/letsencrypt/csr/0000_csr-certbot.pem b/config/letsencrypt/etc/letsencrypt/csr/0000_csr-certbot.pem new file mode 100644 index 0000000..cbd85c4 --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/csr/0000_csr-certbot.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIEdTCCAl0CAQIwADCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOCW +rSodG741Tny9B2bI3engXIRom7qa62I3B5ph/zlcS2svMnfglQ+bzsQG/rGrUqG3 +cmfizNbEb3BCspKjuImyODwZ0ebkuAqkbPtnruAzoR2KbY73wMPPzH6FLYit1xAA +O3YAcge9gbfRnqVqSd8pzm4xoxNFkS4fLTyrLFWYakFzpjCNR0UDj3TSe0XE5/uR +oa6R/JVSJ5Lt85sK8Wj1jeF6bZHDr5NLD1Fij4xmG18B4cG2eqV4gBEDoGwLpwyM +ZicV0Wq6pvUn2c0VlmVxfPugitWyndypGZZ4LxzBlQ79AIvnl5IjWqzAN1QCKmnA +HspgLd60D7cI0dmSu2eNZyp0hy0Zupe9+AcAwPLzlqangAgFBdpa5BXuU+i5s+5J +AzWOpTCMj6mCP4RzxLoYbuRbAAWimQf3NZdGu0+1LVUnvd8q2weBCOlxWVdOiZSf +03fH+9DvpZzabDDjXdLVlLHdb9iFN8nBvGlt9Gny3NhpaIyrMpENX5RBesHe7iFH +XWtOnOlIKyBwSw2QN1EVuEt9eSSYsD6rLYjGwSxpltvti7nITJrUzs803psl5AED +AKjY1J4r/D4Mzu3OsGmkH9gt6KvPwyFOA6zjFis6ZLSPAkWnzr9tuioz216vHmF7 +pW2s8z8by6lq29dN165+JkZm/KUAxF+GvtfXv0SBAgMBAAGgMDAuBgkqhkiG9w0B +CQ4xITAfMB0GA1UdEQQWMBSCEnZpbGxhZmxldXJpZWdwLmNvbTANBgkqhkiG9w0B +AQsFAAOCAgEAM0bh+8DuRfbz+Vw5rseX2awsaBrqCscMGBd4KOZf1UMqHfNFhmGX +atvJQaoKQ2fGQPJC3bKD1D6dydOAFPMR4dd5bQrpYt/pf4RahXknBBIiwkCCWwo0 +UOxN4AFPeJE5pnibv87vVAwz0Cxa9g8ZyUKJkwgqmWLXtDlEhVG+OOT9AB0O+ppi +FeZ1x22yfvkofYmTXs7lepOsMhv0X3SSodp9kQ2XS+Ny31KWJx2/xEW6k7WiEGYz +5qzne4EMhIjBnTpp6bxwQfwg2YSCNRVic4XqoHl3eYq5tYMbyoiIVR89aV56/WrF +2V29t6INOJBke57W9srHBAWRrRec9s0OhSTph5p8FsaAH8KXgC516JKIWC4Zx0vW +BDKMBNdkInqIAXfLlfNHceQrd+/wws4Uco6urTTtBuLeOl4NWuS451+OVmuJakCe +cbOCkcbkb3Tp7dwQdrAEcYLt0+dBBWckbJeQRicH92LjT/obyY7w84uH+T0zl6xM +SJ6+sHqrQj2JJLo/Dg3AYTVLCU5Lpf2TypXozzQrSkmtLiKePYuobxyi3wO/Gk1w +nZxPHc7ziK+VomwLbrYfrLbQAPQ9c35Xp1bbU8uRJ6RkaP/IgWiu91zkpSOWfVx/ +NVLFlpzOZSQJIHJUggqPPsPhrdZbxCZq2QwkNH8sTbmO7Q/ZoYJBrvQ= +-----END CERTIFICATE REQUEST----- diff --git a/config/letsencrypt/etc/letsencrypt/csr/0001_csr-certbot.pem b/config/letsencrypt/etc/letsencrypt/csr/0001_csr-certbot.pem new file mode 100644 index 0000000..255d9c1 --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/csr/0001_csr-certbot.pem @@ -0,0 +1,26 @@ +-----BEGIN CERTIFICATE REQUEST----- +MIIEdTCCAl0CAQIwADCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALh6 +v2k/PmWpxV8xkMGJ3qKqeM/13yYW9dFP9J2USGn4ZGDYICf9nTK10q1kv6g97rT0 +/ia3RPE4bCdTOQvi+S9vyXMLv742oSYjAKWmcovQNDs4bk6y87BMAs50v5DPV/6D +2H5g0hiuuzxx1+liSKUJJflO80t7zQW9x0ZvQw6cBDCpkIqoe0x52TxlLsyxVrGi +RcgBpi8r3hAGXLZ2CaZRncil8Mi3iAo1jfI+JbAGOdv+oip356SHgBSIT1VFgFZP +zfTzh8LskGjJMNd+PZPQoCFr1H1n0NvG4YrTvwz3+sE2hvx/uwMsu8elpHBn7POU +yXB/sV9wUZZSjdPlITwau6MtBuxPa1mINgGq2CdlQsxtrN8z0ZqHdIXkF1+pd21M +onkUAu7vX0KiCmeubviFJ0FtRznaUPcEtBUMqvs0BuOve8uJFogd8XNiTPY7MWPS +Y3FqShc2PKDSrTH0Csdxx7q7eoHB9oseFLaGSjRq8NNFSrC8dEnWps0I0bzYHPMQ +sKEjONglPqgyytpOUOq+GUwWfEkvhIDoBKWOFRnN/aOYrCXunsEHrYpOh7CohRXt +71CuW1zkv3E2ojKaF6tL4/2ar97yXjNmwdJnc7VAMmm/kN7eNXPPTPaOdzgE1ueo +yVLpZCrLVUmamIJwqW+fyCcEYk9CgCe+vHKC4aOpAgMBAAGgMDAuBgkqhkiG9w0B +CQ4xITAfMB0GA1UdEQQWMBSCEnZpbGxhZmxldXJpZWdwLmNvbTANBgkqhkiG9w0B +AQsFAAOCAgEAo+XwnNvcbib0D23xGrI9CA3qXbgCc+5U1+W2l4HMsOlgYYm6g1NX +Ij6grc/yPKtPDUbdNtA1txeXghfDvPj4EgVDCkkxZ5ph3RqkLpv9YMYuWuyVDmeJ +UNBN8GHYb7SSChKAqK4D89DgMgjdLOxZS4TqU7hbn7/EjfX/ZFLHsjtl9Ae6uqUa +V9sd6BobIddO3V/bgP/CScJvhsUSpYOQHaxB2fArXXIyee1soI9DIfvyyD9ocqNz +rzw2uPpwRAFyyMobOzRBX7IQURL6dvdBmwiFkN7C2JcsgjAssjSA7wuzob2MOsDQ +glVMeVFvNX9+r7bg/m7yW9KnYFOSykiGMNBX/wSZIOjcDVOPgziMyPYf74vTmGDz +Mbbl+T1NVQC40QxVbvmigdGZM6jog0KAUOlpnJyWnYPI1ywTzCIEyq+YfTMmoE64 +kPjUjb9PIZKLNjMXZfo8wmkgh9Aamspy2AyxnBSwJbMrY2oOvQJn7grnHOYwXX05 +MkxHA3gmunINiFr9lENue8isK5zcXQ2gwJo2XRsYbGCa7hn2qIXblEAWoZw3CEcV +5W/+w8GbIhuDDkxrnGHcjLD1DcQ9beH81Fc9j/xneZhEDRllJCfJoJsFAlQbEkPD +F+9OHMeTW59LgPMK3A3EdlfyFsGDUkS68C+qylJ22kmmIBvZgrt3P2M= +-----END CERTIFICATE REQUEST----- diff --git a/config/letsencrypt/etc/letsencrypt/keys/0000_key-certbot.pem b/config/letsencrypt/etc/letsencrypt/keys/0000_key-certbot.pem new file mode 100644 index 0000000..968d0f3 --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/keys/0000_key-certbot.pem @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDglq0qHRu+NU58 +vQdmyN3p4FyEaJu6mutiNweaYf85XEtrLzJ34JUPm87EBv6xq1Kht3Jn4szWxG9w +QrKSo7iJsjg8GdHm5LgKpGz7Z67gM6Edim2O98DDz8x+hS2IrdcQADt2AHIHvYG3 +0Z6laknfKc5uMaMTRZEuHy08qyxVmGpBc6YwjUdFA4900ntFxOf7kaGukfyVUieS +7fObCvFo9Y3hem2Rw6+TSw9RYo+MZhtfAeHBtnqleIARA6BsC6cMjGYnFdFquqb1 +J9nNFZZlcXz7oIrVsp3cqRmWeC8cwZUO/QCL55eSI1qswDdUAippwB7KYC3etA+3 +CNHZkrtnjWcqdIctGbqXvfgHAMDy85amp4AIBQXaWuQV7lPoubPuSQM1jqUwjI+p +gj+Ec8S6GG7kWwAFopkH9zWXRrtPtS1VJ73fKtsHgQjpcVlXTomUn9N3x/vQ76Wc +2mww413S1ZSx3W/YhTfJwbxpbfRp8tzYaWiMqzKRDV+UQXrB3u4hR11rTpzpSCsg +cEsNkDdRFbhLfXkkmLA+qy2IxsEsaZbb7Yu5yEya1M7PNN6bJeQBAwCo2NSeK/w+ +DM7tzrBppB/YLeirz8MhTgOs4xYrOmS0jwJFp86/bboqM9terx5he6VtrPM/G8up +atvXTdeufiZGZvylAMRfhr7X179EgQIDAQABAoICAQDed6L0cn0GvxsOKNjqEdLw +VtSOPGj2QXskgMpBPQ1qLmhutgPSB17gZUA9oYgtSj3B/0uOaHTr0Q1qMEdfRloH +28gkkJcBllJQCGwD5MKvR7Uy4+p+kiAaVv6D3TwrhbfhG7nKu8o4rJmQEk6KIG0o +Z+sZ8IVPE7wp6awPyqdR6nZmez6GHYwZattxpwWBKPl6ktmLaQTAjO6ydo62Z/KW +O5bdYT6kAykqSFHWFkGHm6VFSUHtduqqemCxedww6qIAphqSYOReSqITefQfWGDv +/6kEQBUGdbY13DOCf257l64leKxP6YqUsfyh3o1v4+1Lb4mQghEt50Mh1dS5JsYG +hEg7+VMiAecg9azGJ1prK3d3ExL3Uv0toMqB3XjlFWMLsheiDUqs/TV03A1UiuZh +NgtyHyWEJpDjdzN+RO2wvaoUdwrBdOTthz5rBV84yVea6EXQrUp+Bla9pqKRytG3 +lsRvhrURvsDl/eIeT+CghcVTjdEpjl5MUyTaXMSt3DAaN8Pf8CGRVBbX/gPF8PWt +EKcb76supDbOuwqdTqU0LGm0Kmyi/exWYaeuaN5Y1ePWy/Rlj8idXKRpgViVFCwC +ffNWdktJ4MFyKG/n819j50sj+zv/qctRiWl+AOU/00v1tXqPhZekMCoK2OnhNAk8 +HM1T9sdxbA1QMR0o9EeBOQKCAQEA9BK+UxUVtJrnjEE0Da4K6Sx3qodF++7ih90j +jE3n2fEKWB1doGPZ0KQv/+HrSPm5Z5RksMEh3fLIyTv+R61KwM18/k8uKl5flX7o +HaBN1zwuiQ/5Q961L9uAlAsNu7/+s2SiQqm/I1a+3Ml8jfP3UKfdeaUcGWaBPf8p +JkmwNyMT53iSipqqnvsfMUCuLvZH9BCjyOmQj59eQSx0vjX0Klk1799+ri81O7Zl +9p05yM3cJeD8kXPmn6fIOKtgRErSCEjIxoOOK7MvO9cOe2VdqdiJ1jb2DnIK5Pxj +fJ1UC3r3H51TO+mV3sEVRTAGyGKDAYqPHoeYmKrNbXRZrT4RawKCAQEA65AwJxig +FhG1le0B7FgWhr+y4tejr98WTqU712CK4qW6dZ7qkE/TbQyhe1p7C9lhSZ6g+A0U +OYtmVmpDgkLMsze7MmMWfdbhTeV/75MHjiAafmTxUCJ1WUHTSMzCiPtdh2JUqlkZ +zREoTShhuhf/FNvollLPTPQDkF8khSveeV8GLqnoyKv+/dQpczyctJCJBhDhImur +CTG8zCy5C6Iq0zkCNivRsRaGtQfJCvjSf/esnw6lqTi95mgjLt5+ZxlKwFdYrqlo +VFIe6IgGriOHPhoYEWMzX23eo6e4DXTqYzwoFJdfTR3IB5FCQwn7u9wPuY1l9APK +zDiIme+y6mgAwwKCAQBH0kApSJoThEXAsuszX1ScmtY32wiQAxKr8jnkroQcUN6/ +YRzM9rUAvV/Wh09qMPoK7dLXZG2n1yqYdMv1oZvOsmkmmHw4QX8VCbwaA7MENBRp +hsbN3vooNApZBgurhOrZNTK+NR8msf8GD1BUoUbUeCEnC5wCKXS8npooRyTQhMT1 +pzhQCwVMNQ9Puf3HmfdAbakUlQ5SBQ6CVSehVVUdJRVHGdg4P3IFuT213TxEx7cR +emw4DQf/USsM6fkw/2dgwrI6IDo0x8yNalI7o291bF/bJl8vjwV/rnlEETPLEQsp +RW1Zwvm0C9NLgb9tNffg+zn0POh9fD1pCQTegtYzAoIBAQCU74lCbtNooLHKpRs+ +L0Ou1q1ntyeLHuWfu+Dl/+hP/LCzhVKRA6eNnxrKPx7lEv/r6BumOb6702NU58Lf +LRT3ixkUdonV7nJtKdmFw9RXC/00ROY94EuJr5DCypOEwEkWPBmDyuoBOgPdJNcF +Lf7dVVztDlZ7NRy7vyv79wymeGoUPuErX3PNUMMUVRJPJ8M6zplJhgGRwpy4Ct7E +eDfTbIv1bCccbD2nX9DA2ylcN2AxALXFFFccwmLcU1hgHyGgEpnDdOC9z14zby2q +FFSB80WcWLg2ceT+XCCGgZFgRLyiqEJdI6NBBZp7gGhlEnHuw3PeoDcsf+H+Ugsx +Iai5AoIBAQDhyxGclGp+gzwwjeuw6F3NExdrY/fuepFNcA9ASarf/eJkNq5Gl2il +oSXDFTgk9rJ52dQnafo1HPqUyViWOXIqBygDWkMMIa8td/+Rwd9BPYesVQAkx7XI +cTV3kg4Aa786sl0eumuo5aeUl00bgFCpm0vCoKWQAJJrYr5hQ83K6RYMIWdnjBXF +ITaA6aiev3M1f9n4cSKvexMqFBuC/fFfmGfVZFMCJ7c5lR6bgIE1Y8G9ALphS7Rs +vOmKUo4JtkwrUpY5szAZ296BSmKORFrgI0H56rr8VHWhwJMML4sID6DeMCSgxXlw +QN9JVcv/TuXsAVPsinm/iRIGfgimA9BL +-----END PRIVATE KEY----- diff --git a/config/letsencrypt/etc/letsencrypt/keys/0001_key-certbot.pem b/config/letsencrypt/etc/letsencrypt/keys/0001_key-certbot.pem new file mode 100644 index 0000000..de55412 --- /dev/null +++ b/config/letsencrypt/etc/letsencrypt/keys/0001_key-certbot.pem @@ -0,0 +1,52 @@ +-----BEGIN PRIVATE KEY----- +MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQC4er9pPz5lqcVf +MZDBid6iqnjP9d8mFvXRT/SdlEhp+GRg2CAn/Z0ytdKtZL+oPe609P4mt0TxOGwn +UzkL4vkvb8lzC7++NqEmIwClpnKL0DQ7OG5OsvOwTALOdL+Qz1f+g9h+YNIYrrs8 +cdfpYkilCSX5TvNLe80FvcdGb0MOnAQwqZCKqHtMedk8ZS7MsVaxokXIAaYvK94Q +Bly2dgmmUZ3IpfDIt4gKNY3yPiWwBjnb/qIqd+ekh4AUiE9VRYBWT83084fC7JBo +yTDXfj2T0KAha9R9Z9DbxuGK078M9/rBNob8f7sDLLvHpaRwZ+zzlMlwf7FfcFGW +Uo3T5SE8GrujLQbsT2tZiDYBqtgnZULMbazfM9Gah3SF5BdfqXdtTKJ5FALu719C +ogpnrm74hSdBbUc52lD3BLQVDKr7NAbjr3vLiRaIHfFzYkz2OzFj0mNxakoXNjyg +0q0x9ArHcce6u3qBwfaLHhS2hko0avDTRUqwvHRJ1qbNCNG82BzzELChIzjYJT6o +MsraTlDqvhlMFnxJL4SA6ASljhUZzf2jmKwl7p7BB62KToewqIUV7e9Qrltc5L9x +NqIymherS+P9mq/e8l4zZsHSZ3O1QDJpv5De3jVzz0z2jnc4BNbnqMlS6WQqy1VJ +mpiCcKlvn8gnBGJPQoAnvrxyguGjqQIDAQABAoICAADVTRgEmRuMcL/FUYoOPVsu +uez2h1N8tw+C9O/hQ5J29L0bPMnxc0xPVexCkDsKTJG0qZEzMrSENLjYv2E2XTnB +n39NhkgtpvytG8ujvNC02AeMcbMZS9B4B2s3S8YzqYoUvl2Twl8qKt5TBU6giwNz +zyAZIzAsFvj3qna++eaO/dXabjSyHhxyUHDdZCC4jFOxD++fUkjUQeSAotqQHesK +Y1QMq9G8QnkJVOLLNRBedtRvifv3Hqy3j/SHyRPxhGrfYWbB0tMmjmBqyDWw9EY+ +ovqDqioG1gKoG0ytOCeu1wsYW/O3//g7s31rWhrH3WIcQeyoJvzvXO744HschdHl +teZx0nIGxMuw8g+7PUjpaGkAfM+WzszGgo51rCBbm4Cslhx3N9qfoeeB9RJ4zICV +veBTNKnjU8BPUsu4F+7ytBB0UwtZcWC/Z/wlW8uuSFHc/PMC7v4KF7jixUrL9hUA +uLqDiqG/pfZ8k8emk2j8eJNlTXPYZt/Z8JBnDI5sLu/4fk4fjTKh8EUEHtGMg5iS +wyWzX153EsInxhIDvWPaYl7Z54aBmJRml3gLf0WAS+0qgYoaOBD7Jth1FBK7Xq7j +0ZKjo2lKa9A0o7i46l01026Wa5EyobkdVet2pfzl9b7mQVM8BI+GdQgedz+i4Xaj ++smNTqaicC9TMBSlIegBAoIBAQDj4mN5BeVT4m12iB+tvgBrym/LBUfUnVeY51P9 +lAwq4MgAYZcmcQ4ZO6dm8jMghVBEoetXZd65wVAVYVGsZukJFfCHuPtacH4KkvBh +3kJH0VmblGVRgXlPB/vJSBvOZM9l0/gjTNHWRB6smDk05pDCtLQZY7F+Go7QCCxv +WgiqHrAttNBivfmTtwH69ZLj6iSGbAjS9Ckxr4IOWhoO3JUNWqUPim0HnK/vcHAQ +eNKh+8Ios/kJZVY0XXkFrUsMEJzmFx+HW2/OE/ZaT85mcW65Q3hBfs2q5lx1G6Xg ++eKWKAewrIJ4el7k5vpQqiAj16febZ2miQiyMrVWKKIAk1WJAoIBAQDPPXBgNQzZ +9X9R5KYNhUPH5Pr+fgLx5Q3oNd6s7NBD5fg/d1LwwLfEYp7PWZBXcta+ZGnoDWIN +2J1bVwz8PfshasJjAV2ZQ0eq86fkzqs8BffJIhMd+DUuVKnMs0xqE9Z8ne9VdThT +uvSf9V+a2aPCj0OZ3xXbIikGQqfaXjb/2BLyUAn09YVelmQmrcf+KwXoWdXXXQWp +vy0XvcFIYmJaY6fPuZVWgFcAIpsi+T9DknDNRTHMmVADj0fTF6nEJ7JJuXHI6GMt +tqtcE26yOz9xnwSluHOffEiZTEy6EnuIEnS5ped+7aayDq0g9vHBfXAFTtVkl5im +FJIWEH/kbHUhAoIBAQDFuEESWjk1ZPoQo97IglgfLg99GOHP6Yx9UAihtXgxI8Kk +AgiBBAp1fjqqqW4Ow1x3j/1/YRW0GbQAOOYCLW/3wB9nwuni+EODrSX/5DWh1lRn +FoQqCapVFdoyM+xcUT9ZXGapSheuToBGw/Sun3XuWZcBiGwRu705Zj4XhwiJggLe +RUmgwq/uqBSBx9xg/2AdeVLWpZ2wTFUNWsPNLTnt0j3wk+wxdJN5rhatVAd9H9DA +PBbRPiljWc6NTGQW3bskL9/dM0p4hP10MlYksDqfZ5jJStnrc9+4g/qSjn04RxcV +BThWi+YVuQpqPpGQR6aQ6I6mVbND2ZdYX/zffvXxAoIBAGod1asNvxTkRluSrwyB +TqHOuE8UC0H9vc9HtkvpvwLlgOZOnWO16uNedF9MR0LgBOHc3PX71FeusXSR8I5A +1pTX681yZ5ERCGOa/D+HK9tCWwzcq9lOvTyKEaBFtz0iB1QsMt8ZdMw7EQPPSzMp +elcnsL/boX9h0IvqGbURRSxgYeM95LtP9QjoDURY++1D7nR5e6wZb8rpn5dmjNAZ +wK70FHujVbrDYMkq7zFLW3+oPqZ9ZfCUGIqaFXcbyMwuX3asxHzRsec4gCpXsPkG +qYfumxyYhGwH4czNawRkbmjQuoBNWWp/GjpWlYQprsUbC/9LzK0DiyCPq/YsYLCA +cMECggEAMingl9LUMrnJbWwQ1EZc5xGzvE6Zd52cgZ6WbVPPP5UoN4Z6rOzqNV0a +mp2+7Ek3m0ttQMx4gzaRHK5rx1Cmc1GLNhwTkDIYWM7NVRZc+nRrUBlLii5GiJMT +WCS0ARbOyQsYENKWyn/g5785+kPK4/y5IQaG3FQ5RrgKeMotQGAN/dIUYQEPlviP +wPIEaJKlpfmzg+lhl82cl8axNpup8ULLUDp8O6FkXYebhDabQXWZxf/g9Xcjw4Xm +PtOwJ8pdsTRG3FuuSet86M2UBXVDM5g5rG6rCEfBXlQjjt/SUaVlq9XwB9R8URMT +p4wUevxJ/y5/Uku32TMb/yE6TBvibg== +-----END PRIVATE KEY----- diff --git a/config/letsencrypt/fail2ban/action.d/abuseipdb.conf b/config/letsencrypt/fail2ban/action.d/abuseipdb.conf new file mode 100644 index 0000000..c53ed48 --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/abuseipdb.conf @@ -0,0 +1,105 @@ +# Fail2ban configuration file +# +# Action to report IP address to abuseipdb.com +# You must sign up to obtain an API key from abuseipdb.com. +# +# NOTE: These reports may include sensitive Info. +# If you want cleaner reports that ensure no user data see the helper script at the below website. +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# +# This action relies on a api_key being added to the above action conf, +# and the appropriate categories set. +# +# Example, for ssh bruteforce (in section [sshd] of `jail.local`): +# action = %(known/action)s +# %(action_abuseipdb)s[abuseipdb_apikey="my-api-key", abuseipdb_category="18,22"] +# +# See below for catagories. +# +# Original Ref: https://wiki.shaunc.com/wikka.php?wakka=ReportingToAbuseIPDBWithFail2Ban +# Added to fail2ban by Andrew James Collett (ajcollett) + +## abuseIPDB Catagories, `the abuseipdb_category` MUST be set in the jail.conf action call. +# Example, for ssh bruteforce: action = %(action_abuseipdb)s[abuseipdb_category="18,22"] +# ID Title Description +# 3 Fraud Orders +# 4 DDoS Attack +# 9 Open Proxy +# 10 Web Spam +# 11 Email Spam +# 14 Port Scan +# 18 Brute-Force +# 19 Bad Web Bot +# 20 Exploited Host +# 21 Web App Attack +# 22 SSH Secure Shell (SSH) abuse. Use this category in combination with more specific categories. +# 23 IoT Targeted +# See https://abuseipdb.com/categories for more descriptions + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# +# ** IMPORTANT! ** +# +# By default, this posts directly to AbuseIPDB's API, unfortunately +# this results in a lot of backslashes/escapes appearing in the +# reports. This also may include info like your hostname. +# If you have your own web server with PHP available, you can +# use my (Shaun's) helper PHP script by commenting out the first #actionban +# line below, uncommenting the second one, and pointing the URL at +# wherever you install the helper script. For the PHP helper script, see +# +# +# --ciphers ecdhe_ecdsa_aes_256_sha is used to workaround a +# "NSS error -12286" from curl as it attempts to connect using +# SSLv3. See https://www.centos.org/forums/viewtopic.php?t=52732 +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = lgm=$(printf '%%s\n...' ""); curl --fail --tlsv1.1 --data "key=" --data-urlencode "comment=$lgm" --data "ip=" --data "category=" "https://www.abuseipdb.com/report/json" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +[Init] +# Option: abuseipdb_apikey +# Notes Your API key from abuseipdb.com +# Values: STRING Default: None +# Register for abuseipdb [https://www.abuseipdb.com], get api key and set below. +# You will need to set the catagory in the action call. +abuseipdb_apikey = diff --git a/config/letsencrypt/fail2ban/action.d/apf.conf b/config/letsencrypt/fail2ban/action.d/apf.conf new file mode 100644 index 0000000..5c4a261 --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/apf.conf @@ -0,0 +1,25 @@ +# Fail2Ban configuration file +# https://www.rfxn.com/projects/advanced-policy-firewall/ +# +# Note: APF doesn't play nicely with other actions. It has been observed to +# remove bans created by other iptables based actions. If you are going to use +# this action, use it for all of your jails. +# +# DON'T MIX APF and other IPTABLES based actions +[Definition] + +actionstart = +actionstop = +actioncheck = +actionban = apf --deny "banned by Fail2Ban " +actionunban = apf --remove + +[Init] + +# Name used in APF configuration +# +name = default + +# DEV NOTES: +# +# Author: Mark McKinstry diff --git a/config/letsencrypt/fail2ban/action.d/badips.conf b/config/letsencrypt/fail2ban/action.d/badips.conf new file mode 100644 index 0000000..6f9513f --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/badips.conf @@ -0,0 +1,19 @@ +# Fail2ban reporting to badips.com +# +# Note: This reports an IP only and does not actually ban traffic. Use +# another action in the same jail if you want bans to occur. +# +# Set the category to the appropriate value before use. +# +# To get see register and optional key to get personalised graphs see: +# http://www.badips.com/blog/personalized-statistics-track-the-attackers-of-all-your-servers-with-one-key + +[Definition] + +actionban = curl --fail --user-agent "" http://www.badips.com/add// + +[Init] + +# Option: category +# Notes.: Values are from the list here: http://www.badips.com/get/categories +category = diff --git a/config/letsencrypt/fail2ban/action.d/badips.py b/config/letsencrypt/fail2ban/action.d/badips.py new file mode 100644 index 0000000..1ad711f --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/badips.py @@ -0,0 +1,398 @@ +# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*- +# vi: set ft=python sts=4 ts=4 sw=4 noet : + +# This file is part of Fail2Ban. +# +# Fail2Ban is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# Fail2Ban is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with Fail2Ban; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. + +import sys +if sys.version_info < (2, 7): # pragma: no cover + raise ImportError("badips.py action requires Python >= 2.7") +import json +import threading +import logging +if sys.version_info >= (3, ): # pragma: 2.x no cover + from urllib.request import Request, urlopen + from urllib.parse import urlencode + from urllib.error import HTTPError +else: # pragma: 3.x no cover + from urllib2 import Request, urlopen, HTTPError + from urllib import urlencode + +from fail2ban.server.actions import ActionBase +from fail2ban.helpers import str2LogLevel + + + +class BadIPsAction(ActionBase): # pragma: no cover - may be unavailable + """Fail2Ban action which reports bans to badips.com, and also + blacklist bad IPs listed on badips.com by using another action's + ban method. + + Parameters + ---------- + jail : Jail + The jail which the action belongs to. + name : str + Name assigned to the action. + category : str + Valid badips.com category for reporting failures. + score : int, optional + Minimum score for bad IPs. Default 3. + age : str, optional + Age of last report for bad IPs, per badips.com syntax. + Default "24h" (24 hours) + key : str, optional + Key issued by badips.com to report bans, for later retrieval + of personalised content. + banaction : str, optional + Name of banaction to use for blacklisting bad IPs. If `None`, + no blacklist of IPs will take place. + Default `None`. + bancategory : str, optional + Name of category to use for blacklisting, which can differ + from category used for reporting. e.g. may want to report + "postfix", but want to use whole "mail" category for blacklist. + Default `category`. + bankey : str, optional + Key issued by badips.com to blacklist IPs reported with the + associated key. + updateperiod : int, optional + Time in seconds between updating bad IPs blacklist. + Default 900 (15 minutes) + loglevel : int/str, optional + Log level of the message when an IP is (un)banned. + Default `DEBUG`. + agent : str, optional + User agent transmitted to server. + Default `Fail2Ban/ver.` + + Raises + ------ + ValueError + If invalid `category`, `score`, `banaction` or `updateperiod`. + """ + + TIMEOUT = 10 + _badips = "https://www.badips.com" + def _Request(self, url, **argv): + return Request(url, headers={'User-Agent': self.agent}, **argv) + + def __init__(self, jail, name, category, score=3, age="24h", key=None, + banaction=None, bancategory=None, bankey=None, updateperiod=900, loglevel='DEBUG', agent="Fail2Ban", + timeout=TIMEOUT): + super(BadIPsAction, self).__init__(jail, name) + + self.timeout = timeout + self.agent = agent + self.category = category + self.score = score + self.age = age + self.key = key + self.banaction = banaction + self.bancategory = bancategory or category + self.bankey = bankey + self.loglevel = str2LogLevel(loglevel) + self.updateperiod = updateperiod + + self._bannedips = set() + # Used later for threading.Timer for updating badips + self._timer = None + + @staticmethod + def isAvailable(timeout=1): + try: + response = urlopen(Request("/".join([BadIPsAction._badips]), + headers={'User-Agent': "Fail2Ban"}), timeout=timeout) + return True, '' + except Exception as e: # pragma: no cover + return False, e + + def logError(self, response, what=''): # pragma: no cover - sporadical (502: Bad Gateway, etc) + messages = {} + try: + messages = json.loads(response.read().decode('utf-8')) + except: + pass + self._logSys.error( + "%s. badips.com response: '%s'", what, + messages.get('err', 'Unknown')) + + def getCategories(self, incParents=False): + """Get badips.com categories. + + Returns + ------- + set + Set of categories. + + Raises + ------ + HTTPError + Any issues with badips.com request. + ValueError + If badips.com response didn't contain necessary information + """ + try: + response = urlopen( + self._Request("/".join([self._badips, "get", "categories"])), timeout=self.timeout) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to fetch categories") + raise + else: + response_json = json.loads(response.read().decode('utf-8')) + if not 'categories' in response_json: + err = "badips.com response lacked categories specification. Response was: %s" \ + % (response_json,) + self._logSys.error(err) + raise ValueError(err) + categories = response_json['categories'] + categories_names = set( + value['Name'] for value in categories) + if incParents: + categories_names.update(set( + value['Parent'] for value in categories + if "Parent" in value)) + return categories_names + + def getList(self, category, score, age, key=None): + """Get badips.com list of bad IPs. + + Parameters + ---------- + category : str + Valid badips.com category. + score : int + Minimum score for bad IPs. + age : str + Age of last report for bad IPs, per badips.com syntax. + key : str, optional + Key issued by badips.com to fetch IPs reported with the + associated key. + + Returns + ------- + set + Set of bad IPs. + + Raises + ------ + HTTPError + Any issues with badips.com request. + """ + try: + url = "?".join([ + "/".join([self._badips, "get", "list", category, str(score)]), + urlencode({'age': age})]) + if key: + url = "&".join([url, urlencode({'key': key})]) + self._logSys.debug('badips.com: get list, url: %r', url) + response = urlopen(self._Request(url), timeout=self.timeout) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to fetch bad IP list") + raise + else: + return set(response.read().decode('utf-8').split()) + + @property + def category(self): + """badips.com category for reporting IPs. + """ + return self._category + + @category.setter + def category(self, category): + if category not in self.getCategories(): + self._logSys.error("Category name '%s' not valid. " + "see badips.com for list of valid categories", + category) + raise ValueError("Invalid category: %s" % category) + self._category = category + + @property + def bancategory(self): + """badips.com bancategory for fetching IPs. + """ + return self._bancategory + + @bancategory.setter + def bancategory(self, bancategory): + if bancategory != "any" and bancategory not in self.getCategories(incParents=True): + self._logSys.error("Category name '%s' not valid. " + "see badips.com for list of valid categories", + bancategory) + raise ValueError("Invalid bancategory: %s" % bancategory) + self._bancategory = bancategory + + @property + def score(self): + """badips.com minimum score for fetching IPs. + """ + return self._score + + @score.setter + def score(self, score): + score = int(score) + if 0 <= score <= 5: + self._score = score + else: + raise ValueError("Score must be 0-5") + + @property + def banaction(self): + """Jail action to use for banning/unbanning. + """ + return self._banaction + + @banaction.setter + def banaction(self, banaction): + if banaction is not None and banaction not in self._jail.actions: + self._logSys.error("Action name '%s' not in jail '%s'", + banaction, self._jail.name) + raise ValueError("Invalid banaction") + self._banaction = banaction + + @property + def updateperiod(self): + """Period in seconds between banned bad IPs will be updated. + """ + return self._updateperiod + + @updateperiod.setter + def updateperiod(self, updateperiod): + updateperiod = int(updateperiod) + if updateperiod > 0: + self._updateperiod = updateperiod + else: + raise ValueError("Update period must be integer greater than 0") + + def _banIPs(self, ips): + for ip in ips: + try: + self._jail.actions[self.banaction].ban({ + 'ip': ip, + 'failures': 0, + 'matches': "", + 'ipmatches': "", + 'ipjailmatches': "", + }) + except Exception as e: + self._logSys.error( + "Error banning IP %s for jail '%s' with action '%s': %s", + ip, self._jail.name, self.banaction, e, + exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) + else: + self._bannedips.add(ip) + self._logSys.log(self.loglevel, + "Banned IP %s for jail '%s' with action '%s'", + ip, self._jail.name, self.banaction) + + def _unbanIPs(self, ips): + for ip in ips: + try: + self._jail.actions[self.banaction].unban({ + 'ip': ip, + 'failures': 0, + 'matches': "", + 'ipmatches': "", + 'ipjailmatches': "", + }) + except Exception as e: + self._logSys.error( + "Error unbanning IP %s for jail '%s' with action '%s': %s", + ip, self._jail.name, self.banaction, e, + exc_info=self._logSys.getEffectiveLevel()<=logging.DEBUG) + else: + self._logSys.log(self.loglevel, + "Unbanned IP %s for jail '%s' with action '%s'", + ip, self._jail.name, self.banaction) + finally: + self._bannedips.remove(ip) + + def start(self): + """If `banaction` set, blacklists bad IPs. + """ + if self.banaction is not None: + self.update() + + def update(self): + """If `banaction` set, updates blacklisted IPs. + + Queries badips.com for list of bad IPs, removing IPs from the + blacklist if no longer present, and adds new bad IPs to the + blacklist. + """ + if self.banaction is not None: + if self._timer: + self._timer.cancel() + self._timer = None + + try: + ips = self.getList( + self.bancategory, self.score, self.age, self.bankey) + # Remove old IPs no longer listed + s = self._bannedips - ips + m = len(s) + self._unbanIPs(s) + # Add new IPs which are now listed + s = ips - self._bannedips + p = len(s) + self._banIPs(s) + self._logSys.log(self.loglevel, + "Updated IPs for jail '%s' (-%d/+%d). Update again in %i seconds", + self._jail.name, m, p, self.updateperiod) + finally: + self._timer = threading.Timer(self.updateperiod, self.update) + self._timer.start() + + def stop(self): + """If `banaction` set, clears blacklisted IPs. + """ + if self.banaction is not None: + if self._timer: + self._timer.cancel() + self._timer = None + self._unbanIPs(self._bannedips.copy()) + + def ban(self, aInfo): + """Reports banned IP to badips.com. + + Parameters + ---------- + aInfo : dict + Dictionary which includes information in relation to + the ban. + + Raises + ------ + HTTPError + Any issues with badips.com request. + """ + try: + url = "/".join([self._badips, "add", self.category, str(aInfo['ip'])]) + if self.key: + url = "?".join([url, urlencode({'key': self.key})]) + self._logSys.debug('badips.com: ban, url: %r', url) + response = urlopen(self._Request(url), timeout=self.timeout) + except HTTPError as response: # pragma: no cover + self.logError(response, "Failed to ban") + raise + else: + messages = json.loads(response.read().decode('utf-8')) + self._logSys.debug( + "Response from badips.com report: '%s'", + messages['suc']) + +Action = BadIPsAction diff --git a/config/letsencrypt/fail2ban/action.d/blocklist_de.conf b/config/letsencrypt/fail2ban/action.d/blocklist_de.conf new file mode 100644 index 0000000..ba6d427 --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/blocklist_de.conf @@ -0,0 +1,84 @@ +# Fail2Ban configuration file +# +# Author: Steven Hiscocks +# +# + +# Action to report IP address to blocklist.de +# Blocklist.de must be signed up to at www.blocklist.de +# Once registered, one or more servers can be added. +# This action requires the server 'email address' and the associated apikey. +# +# From blocklist.de: +# www.blocklist.de is a free and voluntary service provided by a +# Fraud/Abuse-specialist, whose servers are often attacked on SSH-, +# Mail-Login-, FTP-, Webserver- and other services. +# The mission is to report all attacks to the abuse departments of the +# infected PCs/servers to ensure that the responsible provider can inform +# the customer about the infection and disable them +# +# IMPORTANT: +# +# Reporting an IP of abuse is a serious complaint. Make sure that it is +# serious. Fail2ban developers and network owners recommend you only use this +# action for: +# * The recidive where the IP has been banned multiple times +# * Where maxretry has been set quite high, beyond the normal user typing +# password incorrectly. +# * For filters that have a low likelihood of receiving human errors +# + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionban = curl --fail --data-urlencode "server=" --data "apikey=" --data "service=" --data "ip=" --data-urlencode "logs=
" --data 'format=text' --user-agent "" "https://www.blocklist.de/en/httpreports.html" + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = + +# Option: email +# Notes server email address, as per blocklist.de account +# Values: STRING Default: None +# +#email = + +# Option: apikey +# Notes your user blocklist.de user account apikey +# Values: STRING Default: None +# +#apikey = + +# Option: service +# Notes service name you are reporting on, typically aligns with filter name +# see http://www.blocklist.de/en/httpreports.html for full list +# Values: STRING Default: None +# +#service = diff --git a/config/letsencrypt/fail2ban/action.d/bsd-ipfw.conf b/config/letsencrypt/fail2ban/action.d/bsd-ipfw.conf new file mode 100644 index 0000000..5116b0d --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/bsd-ipfw.conf @@ -0,0 +1,91 @@ +# Fail2Ban configuration file +# +# Author: Nick Munger +# Modified by: Ken Menzel +# Daniel Black (start/stop) +# Fabian Wenk (many ideas as per fail2ban users list) +# +# Ensure firewall_enable="YES" in the top of /etc/rc.conf +# + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = ipfw show | fgrep -c -m 1 -s 'table()' > /dev/null 2>&1 || ( ipfw show | awk 'BEGIN { b = } { if ($1 < b) {} else if ($1 == b) { b = $1 + 1 } else { e = b } } END { if (e) exit e
else exit b }'; num=$?; ipfw -q add $num from table\(
\) to me ; echo $num > "" ) + + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = [ ! -f ] || ( read num < ""
ipfw -q delete $num
rm "" ) + + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +# requires an ipfw rule like "deny ip from table(1) to me" +actionban = e=`ipfw table
add 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XADD): File exists' ] || echo "$e" | grep -q "record already exists" || { echo "$e" 1>&2; exit $x; } + + +# Option: actionunban +# Notes.: command executed when unbanning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: See jail.conf(5) man page +# Values: CMD +# +actionunban = e=`ipfw table
delete 2>&1`; x=$?; [ $x -eq 0 -o "$e" = 'ipfw: setsockopt(IP_FW_TABLE_XDEL): No such process' ] || echo "$e" | grep -q "record not found" || { echo "$e" 1>&2; exit $x; } + +[Init] +# Option: table +# Notes: The ipfw table to use. If a ipfw rule using this table already exists, +# this action will not create a ipfw rule to block it and the following +# options will have no effect. +# Values: NUM +table = 1 + +# Option: port +# Notes.: Specifies port to monitor. Blank indicate block all ports. +# Values: [ NUM | STRING ] +# +port = + +# Option: startstatefile +# Notes: A file to indicate that the table rule that was added. Ensure it is unique per table. +# Values: STRING +startstatefile = /var/run/fail2ban/ipfw-started-table_
+ +# Option: block +# Notes: This is how much to block. +# Can be "ip", "tcp", "udp" or various other options. +# Values: STRING +block = ip + +# Option: blocktype +# Notes.: How to block the traffic. Use a action from man 5 ipfw +# Common values: deny, unreach port, reset +# ACTION defination at the top of man ipfw for allowed values. +# Values: STRING +# +blocktype = unreach port + +# Option: lowest_rule_num +# Notes: When fail2ban starts with action and there is no rule for the given table yet +# then fail2ban will start looking for an empty slot starting with this rule number. +# Values: NUM +lowest_rule_num = 111 + + diff --git a/config/letsencrypt/fail2ban/action.d/cloudflare.conf b/config/letsencrypt/fail2ban/action.d/cloudflare.conf new file mode 100644 index 0000000..1c48a37 --- /dev/null +++ b/config/letsencrypt/fail2ban/action.d/cloudflare.conf @@ -0,0 +1,78 @@ +# +# Author: Mike Rushton +# +# IMPORTANT +# +# Please set jail.local's permission to 640 because it contains your CF API key. +# +# This action depends on curl. +# Referenced from http://www.normyee.net/blog/2012/02/02/adding-cloudflare-support-to-fail2ban by NORM YEE +# +# To get your CloudFlare API Key: https://www.cloudflare.com/a/account/my-account +# +# CloudFlare API error codes: https://www.cloudflare.com/docs/host-api.html#s4.2 + +[Definition] + +# Option: actionstart +# Notes.: command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false). +# Values: CMD +# +actionstart = + +# Option: actionstop +# Notes.: command executed at the stop of jail (or at the end of Fail2Ban) +# Values: CMD +# +actionstop = + +# Option: actioncheck +# Notes.: command executed once before each actionban command +# Values: CMD +# +actioncheck = + +# Option: actionban +# Notes.: command executed when banning an IP. Take care that the +# command is executed with Fail2Ban user rights. +# Tags: IP address +# number of failures +#