anleitung cccam mit fail2ban und firewallscript

/etc/fail2ban/filter.d/

# Fail2Ban configuration file 
# 
# Author: Cyril Jaquier 
# 
# $Revision: 510 $ 
# 
[Definition] 
# Option: failregex 
# Notes.: regex to match the password failures messages in the logfile. The 
# host must be matched by a group named "host". The tag "<HOST>" can 
# be used for standard IP/hostname matching and is only an alias for 
# (?:::f{4,6}:)?(?P<host>\S+) 
# Values: TEXT 
# 
failregex = CCcam: kick <HOST>, signature failed 
# Option: ignoreregex 
# Notes.: regex to ignore. If this regex matches, the line is ignored. 
# Values: TEXT 
# 
ignoreregex =

# Fail2Ban configuration file 
# 
# Author: Cyril Jaquier 
# 
# $Revision: 510 $ 
# 
[Definition] 
# Option: failregex 
# Notes.: regex to match the password failures messages in the logfile. The 
# host must be matched by a group named "host". The tag "<HOST>" can 
# be used for standard IP/hostname matching and is only an alias for 
# (?:::f{4,6}:)?(?P<host>\S+) 
# Values: TEXT 
# 
failregex = CCcam: double login .*, .* \(<HOST>\) 
# Option: ignoreregex 
# Notes.: regex to ignore. If this regex matches, the line is ignored. 
# Values: TEXT 
# 
ignoreregex =

/etc/fail2ban/

[cccam_signaturefailed]

enabled = true
port = 12000 
filter = cccam-signature 
logpath = /var/log/daemon.log 
bantime = 86400
maxretry = 10 


[cccam_doublelogin] 

enabled = true 
port = 12000 
filter = cccam-login 
logpath = /var/log/daemon.log 
bantime = 86400
maxretry = 10

/etc/init.d/firewall stop

/var/log/fail2ban

#!/bin/sh
# script written by Gargi 2009 http://www.gargi.org

#needed modules
modprobe ip_conntrack_ftp

BLACKLIST=/usr/local/etc/blacklist.txt

#trigger for your ports
IN_ALLOWED_TCP="21 22 25 53 80 UmgeleitetePort cccamPort webinfoPort"
OUT_ALLOWED_TCP="21 22 25 53 80 UmgeleitetePort cccamPort webinfoPort"" 
IN_ALLOWED_UDP="53 7878"
OUT_ALLOWED_UDP="53"
IN_ALLOWED_ICMP=" "
OUT_ALLOWED_IMCP=" "

case "$1" in
   start)

      # Stopping IP trap
      /etc/init.d/fail2ban stop
      echo "Stopping fail2ban IP trap ..."

      # Clear iptables
      iptables -F

      #Defaults
      iptables -P INPUT DROP
      iptables -P OUTPUT DROP
      iptables -P FORWARD DROP

      # loopback communication
      iptables -A INPUT -i lo -j ACCEPT
      iptables -A OUTPUT -o lo -j ACCEPT

      # persist on connections
      iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

      # Ban blacklisted IPs
      for x in `grep -v ^# $BLACKLIST | awk '{print $1}'`; do
        echo "Blocking $x..."
        iptables -A INPUT -t filter -s $x -j DROP
      done

      # TCP rules in
      for port in $IN_ALLOWED_TCP; do
        echo "Accepting TCP port $port"
        iptables -A INPUT -t filter -p tcp --dport $port -j ACCEPT
      done

      # TCP rules out
      for port in $OUT_ALLOWED_TCP; do
        echo "Allowing sending over TCP port $port"
        iptables -A OUTPUT -t filter -p tcp --dport $port -j ACCEPT
      done

      # UDP rules in
      for port in $IN_ALLOWED_UDP; do
        echo "Accepting UDP  port $port"
        iptables -A INPUT -t filter -p udp --dport $port -j ACCEPT
      done

      # UDP  rules out
      for port in $OUT_ALLOWED_UDP; do
        echo "Allowing sending over UDP port $port"
        iptables -A OUTPUT -t filter -p udp --dport $port -j ACCEPT
      done

      # ICMP rules in
      for port in $IN_ALLOWED_ICMP; do
        echo "Accepting ICMP  port $port"
        iptables -A INPUT -t filter -p icmp --dport $port -j ACCEPT
      done

      # ICMP rules out
      for port in $OUT_ALLOWED_ICMP; do
        echo "Allowing sending over ICMP port $port"
        iptables -A OUTPUT -t filter -p icmp --dport $port -j ACCEPT
      done

      # Dropping startup requests
      iptables -A INPUT -t filter -p tcp --syn -j DROP

      # Restarting IP trap
      /etc/init.d/fail2ban start
      echo "Fire up IP trap again ..."
      ;;
   stop)
      /etc/init.d/fail2ban stop
      iptables -F
      iptables -P INPUT ACCEPT
      iptables -P OUTPUT ACCEPT
      echo "Warning! Firewall is stopped, server is unprotected now!"
      ;;
   restart)
      $0 stop
      sleep 1
      $0 start
      ;;
      *)
      echo "Usage $0 {start|stop|restart}"
      ;;
esac

/etc/init.d/firewall stop

/etc/init.d/firewall stop

/etc/init.d/firewall start