daily

Author: szepeviktor

backup/system-backup-install.sh

@@ -31,7 +31,8 @@ mkdir -p /root/.config/system-backup
 cat >/root/.config/system-backup/configuration <<EOF
 STORAGE_URL="$(sed -n -e 's|^storage-url:\s*\(\S\+\)$|\1|p' /root/.s3ql/authinfo2)"
 TARGET="/media/server-backup.s3ql"
-#MOUNT_OPTIONS="--threads 4 --compress zlib-5"
+#MOUNT_OPTIONS="--max-cache-entries 10240 --threads 4 --compress zlib-5"
+#ulimit -n 10500
 MOUNT_OPTIONS="--compress zlib-5"
 AUTHFILE="/root/.s3ql/authinfo2"
 #DB_EXCLUDE="excluded-db1|excluded-db2"

debian-setup/packages/s3ql

@@ -4,7 +4,7 @@
 #
 
 # https://github.com/s3ql/s3ql/releases
-S3QL_VERSION="5.4.0"
+S3QL_VERSION="5.4.2"
 S3QL_PATH="/opt/s3ql"
 
 set -e -x

monitoring/apache-xreport.sh

@@ -36,6 +36,8 @@ Xclude_filter()
 |w4wp_|bad_request_|no_wp_here_|404_not_found|403_forbidden|File does not exist:\
 |client denied by server configuration:)" \
         | grep -Evx '\[.* 06:.* [0-9][0-9][0-9][0-9]\] \[\S+:(info|notice)\] \[pid [0-9]+:tid [0-9]+\] (AH00493|AH00830|AH01887|AH01876|AH03090|AH00489|AH00490|AH00094|AH01883|h2_workers):.*' \
+        | grep -Ev '\sAH00126: Invalid URI in request\s' \
+        | grep -Ev '\sAH10244: invalid URI path\s' \
 
 }
 
@@ -82,7 +84,7 @@ while read -r CONFIG_FILE; do
     nice dategrep --format '%a %b %d %T(.[0-9]+)? %Y' --multiline \
         --start "now truncate 24h add -17h35m" --end "06:25:00" "$ERROR_LOG".[1] "$ERROR_LOG" \
         | Xclude_filter \
-        | sed "s;^;$(basename "$ERROR_LOG" .log): ;"
+        | sed -e "s|^|$(basename "$ERROR_LOG" .log): |"
 
 done <<<"$APACHE_CONFIGS" | Maybe_sendmail
 

security/fail2ban-conf/jail.local

@@ -31,6 +31,10 @@ destemail = admin@szepe.net
 # Separate chain for Fail2ban
 chain = fail2ban
 
+# Use iptables
+banaction = iptables-multiport
+banaction_allports = iptables-allports
+
 # Ban & send an e-mail with GEOIP data and relevant log lines
 action_mgl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s", actionstart_on_demand=false]
              sendmail-geoip-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]

security/myattackers-ipsets/ipset/onyphe.ipset

@@ -0,0 +1,16 @@
+# AS213412 - ONYPHE
+#: ipset -exist restore <ipset/onyphe.ipset
+#: iptables -w -I myattackers-ipset -m set --match-set onyphe src -j REJECT
+create onyphe hash:net family inet hashsize 64 maxelem 32
+flush onyphe
+#$ wget -qO- https://smith.probe.onyphe.net/ip-ranges.txt|sort -Vu|sed -e 's#^#add onyphe #'
+add onyphe 51.254.49.96/28
+add onyphe 91.196.152.0/24
+add onyphe 91.230.168.0/24
+add onyphe 91.231.89.0/24
+add onyphe 94.231.206.0/24
+add onyphe 195.184.76.0/24
+
+#add onyphe 2a14:f100::/29
+#add onyphe 2001:41d0:33a:a00::400/124
+#add onyphe 2001:41d0:33d:9200::400/124