hectorzhao/lislgosms
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat: add Fail2ban security detection console

Browse Source
This commit is contained in:
hectorzhao
2026-08-14 10:58:18 +08:00
parent b78faa1aa2
commit d30d9ea4d0
45 changed files with 1967 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/deploy/production-bootstrap.sh
+15 -1
View File
@@ -33,6 +33,8 @@ SMS_RECEIPT_TIMEOUT_HOURS="${SMS_RECEIPT_TIMEOUT_HOURS:-72}"
SMS_RECEIPT_TIMEOUT_SCAN_INTERVAL_MS="${SMS_RECEIPT_TIMEOUT_SCAN_INTERVAL_MS:-300000}"
PROMETHEUS_URL="${PROMETHEUS_URL:-http://127.0.0.1:9090}"
PROMETHEUS_QUERY_TIMEOUT_MS="${PROMETHEUS_QUERY_TIMEOUT_MS:-5000}"
SECURITY_EVENT_TOKEN="${SECURITY_EVENT_TOKEN:-$(openssl rand -hex 32 | tr -d '\n')}"
SECURITY_BUILTIN_PROTECTED_NETWORKS="${SECURITY_BUILTIN_PROTECTED_NETWORKS:-${CMPP_PUBLIC_HOST}/32}"
if [[ "$(id -u)" -ne 0 ]]; then
echo "Run as root." >&2
@@ -45,7 +47,7 @@ install_packages() {
log "Installing OS packages"
if command -v apt-get >/dev/null 2>&1; then
apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl gnupg git nginx redis-server postgresql postgresql-contrib build-essential tar gzip xz-utils openssl
DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl gnupg git nginx redis-server postgresql postgresql-contrib build-essential tar gzip xz-utils openssl fail2ban nftables
elif command -v dnf >/dev/null 2>&1; then
dnf install -y ca-certificates curl git nginx redis postgresql-server postgresql-contrib gcc gcc-c++ make tar gzip xz openssl
if [[ ! -d /var/lib/pgsql/data/base ]]; then
@@ -208,6 +210,10 @@ GATEWAY_CMPP_ADDR=${GATEWAY_CMPP_ADDR}
CMPP_PUBLIC_HOST=${CMPP_PUBLIC_HOST}
CMPP_PUBLIC_PORT=${CMPP_PUBLIC_PORT}
API_BASE_URL=http://127.0.0.1:${API_PORT}/api
SECURITY_EVENT_TOKEN=${SECURITY_EVENT_TOKEN}
SECURITY_AGENT_SOCKET=/run/cmpp-security-agent/agent.sock
TRUSTED_PROXY_IPS=127.0.0.1,::1
SECURITY_BUILTIN_PROTECTED_NETWORKS=${SECURITY_BUILTIN_PROTECTED_NETWORKS}
EOF
chmod 600 /etc/cmpp-platform/cmpp-platform.env
cat >/etc/cmpp-platform/minio.env <<EOF
@@ -221,6 +227,11 @@ write_services() {
log "Writing systemd and nginx configuration"
local node_bin
node_bin="$(command -v node)"
getent group cmpp-security >/dev/null || groupadd --system cmpp-security
id cmpp-api >/dev/null 2>&1 || useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin --gid cmpp-security cmpp-api
install -d -m 0750 /etc/nginx/snippets
touch /etc/nginx/snippets/cmpp-security-deny.conf
chmod 0640 /etc/nginx/snippets/cmpp-security-deny.conf
cat >/etc/systemd/system/cmpp-minio.service <<'EOF'
[Unit]
Description=CMPP MinIO object storage
@@ -244,6 +255,8 @@ Description=CMPP Platform API
After=network.target postgresql.service redis.service cmpp-minio.service
[Service]
User=cmpp-api
Group=cmpp-security
WorkingDirectory=${APP_DIR}/api
EnvironmentFile=/etc/cmpp-platform/cmpp-platform.env
ExecStart=${node_bin} dist/main.js
@@ -286,6 +299,7 @@ server {
gzip_min_length 1024;
gzip_comp_level 5;
gzip_types application/json application/javascript text/javascript text/css text/plain text/csv image/svg+xml;
include /etc/nginx/snippets/cmpp-security-deny.conf;
location /api/ {
proxy_pass http://127.0.0.1:${API_PORT}/api/;
tools/deploy/production-deploy.sh
+5
View File
@@ -52,6 +52,7 @@ rm -rf api/dist api/tsconfig.build.tsbuildinfo "$APP_DIR/dist/cmpp-gateway"
npm run build
npm --prefix api run build
(cd gateway && GOPROXY="${GOPROXY:-https://goproxy.cn,direct}" /usr/local/bin/go build -o "$APP_DIR/dist/cmpp-gateway" ./cmd/gateway)
(cd gateway && GOPROXY="${GOPROXY:-https://goproxy.cn,direct}" /usr/local/bin/go build -o "$APP_DIR/dist/cmpp-security-agent" ./cmd/security-agent)
chmod 755 "$APP_DIR/dist" "$APP_DIR/dist/assets"
find "$APP_DIR/dist/assets" -type d -exec chmod 755 {} +
find "$APP_DIR/dist/assets" -type f -exec chmod 644 {} +
@@ -64,6 +65,9 @@ chmod 600 "$ADMIN_CREDENTIAL_FILE" || true
echo "[deploy] Ensuring runtime log directories"
install -d -m 0755 "$APP_DIR/logs/api" "$APP_DIR/logs/gateway"
echo "[deploy] Installing restricted security boundary"
bash "$APP_DIR/tools/security/install-security-agent.sh"
echo "[deploy] Ensuring HTTP response compression"
cat >/etc/nginx/conf.d/cmpp-compression.conf <<'EOF'
gzip on;
@@ -85,6 +89,7 @@ else
systemctl enable --now cmpp-api cmpp-gateway nginx
fi
systemctl restart cmpp-gateway
systemctl restart cmpp-security-agent
systemctl restart cmpp-api
systemctl restart nginx
tools/security/install-security-agent.sh
+51
View File
@@ -0,0 +1,51 @@
#!/usr/bin/env bash
set -Eeuo pipefail
APP_DIR="${APP_DIR:-/opt/cmpp-platform}"
if [[ "$(id -u)" -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
for command_name in fail2ban-client nft nginx systemctl; do command -v "$command_name" >/dev/null || { echo "Missing command: $command_name" >&2; exit 1; }; done
[[ -x "$APP_DIR/dist/cmpp-security-agent" ]] || { echo "Missing built security agent" >&2; exit 1; }
getent group cmpp-security >/dev/null || groupadd --system cmpp-security
id cmpp-api >/dev/null 2>&1 || useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin cmpp-api
usermod -a -G cmpp-security cmpp-api
install -d -o root -g cmpp-security -m 0770 /run/cmpp-security-agent
install -d -o root -g cmpp-security -m 0750 /var/lib/cmpp-security-agent
install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/api"
[[ -d /var/lib/cmpp-platform/object-storage ]] && chown -R cmpp-api:cmpp-security /var/lib/cmpp-platform/object-storage
install -m 0640 "$APP_DIR/deploy/security/cmpp-report-only.conf" /etc/fail2ban/action.d/cmpp-report-only.conf
install -m 0640 "$APP_DIR/deploy/security/cmpp-http-scan.conf" /etc/fail2ban/filter.d/cmpp-http-scan.conf
install -d -m 0750 /etc/nginx/snippets /etc/nftables.d
touch /etc/nginx/snippets/cmpp-security-deny.conf
chmod 0640 /etc/nginx/snippets/cmpp-security-deny.conf
cat >/etc/nftables.d/cmpp-security.nft <<'EOF'
table inet cmpp_security {
set blocked_ipv4 { type ipv4_addr; flags timeout; }
set blocked_ipv6 { type ipv6_addr; flags timeout; }
chain input { type filter hook input priority -10; policy accept; ip saddr @blocked_ipv4 drop; ip6 saddr @blocked_ipv6 drop; }
}
EOF
grep -q 'cmpp-security.nft' /etc/nftables.conf || printf '\ninclude "/etc/nftables.d/cmpp-security.nft"\n' >>/etc/nftables.conf
nft -c -f /etc/nftables.conf
nft list table inet cmpp_security >/dev/null 2>&1 || nft -f /etc/nftables.d/cmpp-security.nft
sed "s#/opt/cmpp-platform/current#$APP_DIR#g" "$APP_DIR/deploy/security/cmpp-security-agent.service" >/etc/systemd/system/cmpp-security-agent.service
install -d -m 0755 /etc/systemd/system/cmpp-api.service.d
cat >/etc/systemd/system/cmpp-api.service.d/security-boundary.conf <<EOF
[Service]
User=cmpp-api
Group=cmpp-security
NoNewPrivileges=true
PrivateTmp=true
ProtectHome=true
ProtectSystem=true
ReadWritePaths=$APP_DIR/logs/api /var/lib/cmpp-platform/object-storage
EOF
fail2ban-client -t
nginx -t
systemctl daemon-reload
systemctl enable cmpp-security-agent
echo "Security boundary installed. Restart cmpp-security-agent and cmpp-api only in the approved release window."