schiwagoaandClaude Opus 5.5
2e3f79236c
Web interface to view, ban and unban fail2ban IPs on several hosts via SSH, generalised from the private f2b-web tool. - Web UI (Flask/Waitress): hosts.yaml, local/OIDC/proxy authentication, English/German UI, origin map, optional Loki/Grafana/GeoIP, CLI helpers - Agent f2b-webctl with install.sh/uninstall.sh (dedicated user + sudo, from= restriction, protected networks, manual jail) - Hardened Docker image, examples, documentation, smoke test, testbed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.6 KiB
1.6 KiB
Security
Reporting a vulnerability
Please do not open a public issue. Send a description and, if possible, steps to reproduce to the maintainer via a private message on git.retronerd.at. You will get an answer within a few days; fixes are released as soon as possible and mentioned in the changelog.
Security model
| Part | Trust | Protection |
|---|---|---|
| Browser → web UI | untrusted | login (local / OIDC / proxy), CSRF token on every change, Origin check, strict CSP, no caching |
| Web UI container | holds the SSH key for all agents | non-root (UID 10050), read-only root FS, no capabilities, no-new-privileges, bound to 127.0.0.1 by default |
| Web UI → agent | SSH with a single ed25519 key | host keys pinned (StrictHostKeyChecking=yes), key restricted with restrict, from= and a forced command |
Agent (f2b-webctl) |
runs as root via one sudo rule | fixed command whitelist, strict IP/jail validation, never bans private, own or protected addresses, syslog of every action |
What the web UI cannot do on a host: open a shell, forward ports, run other commands, change fail2ban configuration, or ban protected addresses.
What an attacker with access to the web UI can do: ban and unban public IPs on the configured hosts. Protect the UI accordingly (strong password or SSO, reverse proxy with TLS, ideally an IP allow list).
Recommendations:
- Always install the agent with
--from <address of the web UI>. - Keep the
data/directory (SSH key, session secret) readable for UID 10050 only. - Rebuild or pull the image regularly – the base image receives Debian security updates.