schiwagoaandClaude Opus 5.5
2e3f79236c
Web interface to view, ban and unban fail2ban IPs on several hosts via SSH, generalised from the private f2b-web tool. - Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication, English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers - Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo, from= restriction, protected networks, manual jail) - Hardened Docker image, examples, documentation, smoke test, testbed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
37 lines
1.3 KiB
Docker
37 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1
|
||
# Test host: sshd + fail2ban (dummy actions, no firewall changes).
|
||
# The agent is installed at start with agent/install.sh – exactly like on a real host.
|
||
# Build context: repository root (see ../docker-compose.yaml)
|
||
FROM debian:trixie-slim
|
||
RUN apt-get update \
|
||
&& apt-get install -y --no-install-recommends openssh-server openssh-client fail2ban python3 sudo iproute2 \
|
||
&& rm -rf /var/lib/apt/lists/* /etc/fail2ban/jail.d/* /etc/ssh/ssh_host_* \
|
||
&& mkdir -p /run/sshd && touch /var/log/empty.log
|
||
|
||
COPY <<'JAIL' /etc/fail2ban/jail.local
|
||
[DEFAULT]
|
||
banaction = dummy
|
||
banaction_allports = dummy
|
||
backend = polling
|
||
|
||
[sshd]
|
||
enabled = true
|
||
logpath = /var/log/empty.log
|
||
JAIL
|
||
|
||
COPY agent/ /opt/fail2ban-webui-agent/
|
||
|
||
COPY <<'ENTRY' /entrypoint.sh
|
||
#!/bin/sh
|
||
set -e
|
||
ssh-keygen -A >/dev/null
|
||
until [ -s /keys/ssh/id_ed25519.pub ]; do echo "waiting for /keys/ssh/id_ed25519.pub"; sleep 2; done
|
||
fail2ban-client -x start >/dev/null
|
||
# INSTALL_ARGS: options for install.sh, set per agent in docker-compose.yaml
|
||
bash /opt/fail2ban-webui-agent/install.sh --yes --key-file /keys/ssh/id_ed25519.pub $INSTALL_ARGS
|
||
for ip in $SAMPLE_BANS; do fail2ban-client set sshd banip "$ip" >/dev/null; done
|
||
exec /usr/sbin/sshd -D -e
|
||
ENTRY
|
||
RUN chmod 0755 /entrypoint.sh
|
||
ENTRYPOINT ["/entrypoint.sh"]
|