Caddy + GeoIP + Fail2Ban (Pushover) — Setup Notes

by
Tags: caddy fail2ban pushover
Categories: webserver linux firewall

This document describes:

  • Building a custom Caddy container image with the GeoIP plugin (so Caddy can enrich access logs with country code/name). - Configuring Caddy JSON access logs to include GeoIP fields. - Setting up Fail2Ban to parse Caddy logs and send Pushover notifications with GeoIP info via mmdblookup. - Optional “SOC dashboard” style fields (severity, jail type, ban time, until).

Read More →

IPtables

by
Tags: iptables firewall netfilter
Categories: linux firewall

## Set default policies
iptables -P INPUT DROP
iptables -P FOWARD DROP
iptables -P OUTPUT DROP

## Allow traffic to and from the loopback interface
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

## Allow outbound connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## Allow others to ping this machine
iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

## Ratelimit incomming SSH connections
iptables -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
iptabes -A INPUT -p tcp --dport ssh -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport ssh -m state --state NEW -j ACCEPT

## Save rules on Debian/Ubuntu
apt install iptables-persistent
netfilter-persistent save

## Save rules on RHEL
chkconfig iptables on
service iptables save



Read More →

Tips and trick using curl

by
Tags: curl
Categories: linux webserver

Download files

curl -O https://test.example.com/madplan.json
curl -O -L http://test.example.com/madplan.json # Follows links. In this example the http request will be redirected to https
curl -o test.json https://test.example.com/test.json # Saves the file as test.json
 

Send host header

Usefull when the server is hosting multiple domains

curl -H "host: test.example.com" http://172.16.0.150


Read More →

Linux VRRP

by
Tags: VRRP DNS Unbound
Categories: Linux

Here’s some configuration examples from a VRRP(Virtual Router Redundancy Protocol) experiment i did. This is used to create a high available DNS resolver with Unbound . I used RHEL 8 as my distribution of choice, but I’m sure this can be used on any RHEL deviate or linux distribution


Read More →