feat: add Fail2ban security detection console

2026-08-14 10:58:18 +08:00
parent b78faa1aa2
commit d30d9ea4d0
45 changed files with 1967 additions and 18 deletions
@@ -0,0 +1,25 @@
+[Unit]
+Description=CMPP restricted security execution agent
+After=network.target fail2ban.service nftables.service
+
+[Service]
+Type=simple
+User=root
+Group=cmpp-security
+EnvironmentFile=/etc/cmpp-platform/cmpp-platform.env
+ExecStart=/opt/cmpp-platform/current/bin/cmpp-security-agent
+Restart=on-failure
+RestartSec=3
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+ReadWritePaths=/run/cmpp-security-agent /var/lib/cmpp-security-agent /etc/nginx/snippets /etc/fail2ban/jail.d
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_DAC_OVERRIDE CAP_KILL
+AmbientCapabilities=CAP_NET_ADMIN CAP_DAC_OVERRIDE
+LockPersonality=true
+MemoryDenyWriteExecute=true
+
+[Install]
+WantedBy=multi-user.target