Created
May 19, 2016 05:03
-
-
Save georg90/4c589e6bbccd5f3e4711984dedee801a to your computer and use it in GitHub Desktop.
fail2ban init.d script for local install (see https://lane6.de)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#! /bin/sh | |
### BEGIN INIT INFO | |
# Provides: fail2ban | |
# Required-Start: $local_fs $remote_fs | |
# Required-Stop: $local_fs $remote_fs | |
# Should-Start: $time $network $syslog iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm | |
# Should-Stop: $network $syslog iptables firehol shorewall ipmasq arno-iptables-firewall iptables-persistent ferm | |
# Default-Start: 2 3 4 5 | |
# Default-Stop: 0 1 6 | |
# Short-Description: Start/stop fail2ban | |
# Description: Start/stop fail2ban, a daemon scanning the log files and | |
# banning potential attackers. | |
### END INIT INFO | |
# Author: Aaron Isotton <aaron@isotton.com> | |
# Modified: by Yaroslav Halchenko <debian@onerussian.com> | |
# reindented + minor corrections + to work on sarge without modifications | |
# Modified: by Glenn Aaldering <glenn@openvideo.nl> | |
# added exit codes for status command | |
# | |
PATH=/usr/sbin:/usr/bin:/usr/local/bin:/sbin:/bin | |
DESC="authentication failure monitor" | |
NAME=fail2ban | |
# fail2ban-client is not a daemon itself but starts a daemon and | |
# loads its with configuration | |
DAEMON=/usr/local/bin/$NAME-client | |
SCRIPTNAME=/etc/init.d/$NAME | |
# Ad-hoc way to parse out socket file name | |
SOCKFILE=`grep -h '^[^#]*socket *=' /etc/$NAME/$NAME.conf /etc/$NAME/$NAME.local 2>/dev/null \ | |
| tail -n 1 | sed -e 's/.*socket *= *//g' -e 's/ *$//g'` | |
[ -z "$SOCKFILE" ] && SOCKFILE='/tmp/fail2ban.sock' | |
# Exit if the package is not installed | |
[ -x "$DAEMON" ] || exit 0 | |
# Run as root by default. | |
FAIL2BAN_USER=root | |
# Read configuration variable file if it is present | |
[ -r /etc/default/$NAME ] && . /etc/default/$NAME | |
DAEMON_ARGS="$FAIL2BAN_OPTS" | |
# Load the VERBOSE setting and other rcS variables | |
[ -f /etc/default/rcS ] && . /etc/default/rcS | |
# Predefine what can be missing from lsb source later on -- necessary to run | |
# on sarge. Just present it in a bit more compact way from what was shipped | |
log_daemon_msg () { | |
[ -z "$1" ] && return 1 | |
echo -n "$1:" | |
[ -z "$2" ] || echo -n " $2" | |
} | |
# Define LSB log_* functions. | |
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present. | |
# Actually has to (>=2.0-7) present in sarge. log_daemon_msg is predefined | |
# so we must be ok | |
. /lib/lsb/init-functions | |
# | |
# Shortcut function for abnormal init script interruption | |
# | |
report_bug() | |
{ | |
echo $* | |
echo "Please submit a bug report to Debian BTS (reportbug fail2ban)" | |
exit 1 | |
} | |
# | |
# Helper function to check if socket is present, which is often left after | |
# abnormal exit of fail2ban and needs to be removed | |
# | |
check_socket() | |
{ | |
# Return | |
# 0 if socket is present and readable | |
# 1 if socket file is not present | |
# 2 if socket file is present but not readable | |
# 3 if socket file is present but is not a socket | |
[ -e "$SOCKFILE" ] || return 1 | |
[ -r "$SOCKFILE" ] || return 2 | |
[ -S "$SOCKFILE" ] || return 3 | |
return 0 | |
} | |
# | |
# Function that starts the daemon/service | |
# | |
do_start() | |
{ | |
# Return | |
# 0 if daemon has been started | |
# 1 if daemon was already running | |
# 2 if daemon could not be started | |
do_status && return 1 | |
if [ -e "$SOCKFILE" ]; then | |
log_failure_msg "Socket file $SOCKFILE is present" | |
[ "$1" = "force-start" ] \ | |
&& log_success_msg "Starting anyway as requested" \ | |
|| return 2 | |
DAEMON_ARGS="$DAEMON_ARGS -x" | |
fi | |
# Assure that /var/run/fail2ban exists | |
[ -d /var/run/fail2ban ] || mkdir -p /var/run/fail2ban | |
if [ "$FAIL2BAN_USER" != "root" ]; then | |
# Make the socket directory, IP lists and fail2ban log | |
# files writable by fail2ban | |
chown "$FAIL2BAN_USER" /var/run/fail2ban | |
# Create the logfile if it doesn't exist | |
touch /var/log/fail2ban.log | |
chown "$FAIL2BAN_USER" /var/log/fail2ban.log | |
find /proc/net/xt_recent -name 'fail2ban-*' -exec chown "$FAIL2BAN_USER" {} \; | |
fi | |
start-stop-daemon --start --quiet --chuid "$FAIL2BAN_USER" --exec $DAEMON -- \ | |
$DAEMON_ARGS start > /dev/null\ | |
|| return 2 | |
return 0 | |
} | |
# | |
# Function that checks the status of fail2ban and returns | |
# corresponding code | |
# | |
do_status() | |
{ | |
$DAEMON ping > /dev/null 2>&1 | |
return $? | |
} | |
# | |
# Function that stops the daemon/service | |
# | |
do_stop() | |
{ | |
# Return | |
# 0 if daemon has been stopped | |
# 1 if daemon was already stopped | |
# 2 if daemon could not be stopped | |
# other if a failure occurred | |
$DAEMON status > /dev/null 2>&1 || return 1 | |
$DAEMON stop > /dev/null || return 2 | |
# now we need actually to wait a bit since it might take time | |
# for server to react on client's stop request. Especially | |
# important for restart command on slow boxes | |
count=1 | |
while do_status && [ $count -lt 60 ]; do | |
sleep 1 | |
count=$(($count+1)) | |
done | |
[ $count -lt 60 ] || return 3 # failed to stop | |
return 0 | |
} | |
# | |
# Function to reload configuration | |
# | |
do_reload() { | |
$DAEMON reload > /dev/null && return 0 || return 1 | |
return 0 | |
} | |
# yoh: | |
# shortcut function to don't duplicate case statements and to don't use | |
# bashisms (arrays). Fixes #368218 | |
# | |
log_end_msg_wrapper() | |
{ | |
if [ "$3" != "no" ]; then | |
[ $1 -lt $2 ] && value=0 || value=1 | |
log_end_msg $value | |
fi | |
} | |
command="$1" | |
case "$command" in | |
start|force-start) | |
[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME" | |
do_start "$command" | |
log_end_msg_wrapper $? 2 "$VERBOSE" | |
;; | |
stop) | |
[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME" | |
do_stop | |
log_end_msg_wrapper $? 2 "$VERBOSE" | |
;; | |
restart|force-reload) | |
log_daemon_msg "Restarting $DESC" "$NAME" | |
do_stop | |
case "$?" in | |
0|1) | |
do_start | |
log_end_msg_wrapper $? 1 "always" | |
;; | |
*) | |
# Failed to stop | |
log_end_msg 1 | |
;; | |
esac | |
;; | |
reload|force-reload) | |
log_daemon_msg "Reloading $DESC" "$NAME" | |
do_reload | |
log_end_msg $? | |
;; | |
status) | |
log_daemon_msg "Status of $DESC" | |
do_status | |
case $? in | |
0) log_success_msg " $NAME is running" ;; | |
255) | |
check_socket | |
case $? in | |
1) log_failure_msg " $NAME is not running" && exit 3 ;; | |
0) log_failure_msg " $NAME is not running but $SOCKFILE exists" && exit 3 ;; | |
2) log_failure_msg " $SOCKFILE not readable, status of $NAME is unknown" && exit 3 ;; | |
3) log_failure_msg " $SOCKFILE exists but not a socket, status of $NAME is unknown" && exit 3 ;; | |
*) report_bug "Unknown return code from $NAME:check_socket." && exit 4 ;; | |
esac | |
;; | |
*) report_bug "Unknown $NAME status code" && exit 4 | |
esac | |
;; | |
*) | |
echo "Usage: $SCRIPTNAME {start|force-start|stop|restart|force-reload|status}" >&2 | |
exit 3 | |
;; | |
esac | |
: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment