feat: add Fail2ban security detection console

2026-08-14 10:58:18 +08:00
parent b78faa1aa2
commit d30d9ea4d0
45 changed files with 1967 additions and 18 deletions
@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+APP_DIR="${APP_DIR:-/opt/cmpp-platform}"
+if [[ "$(id -u)" -ne 0 ]]; then echo "Run as root." >&2; exit 1; fi
+for command_name in fail2ban-client nft nginx systemctl; do command -v "$command_name" >/dev/null || { echo "Missing command: $command_name" >&2; exit 1; }; done
+[[ -x "$APP_DIR/dist/cmpp-security-agent" ]] || { echo "Missing built security agent" >&2; exit 1; }
+
+getent group cmpp-security >/dev/null || groupadd --system cmpp-security
+id cmpp-api >/dev/null 2>&1 || useradd --system --home-dir /nonexistent --shell /usr/sbin/nologin cmpp-api
+usermod -a -G cmpp-security cmpp-api
+install -d -o root -g cmpp-security -m 0770 /run/cmpp-security-agent
+install -d -o root -g cmpp-security -m 0750 /var/lib/cmpp-security-agent
+install -d -o cmpp-api -g cmpp-security -m 0750 "$APP_DIR/logs/api"
+[[ -d /var/lib/cmpp-platform/object-storage ]] && chown -R cmpp-api:cmpp-security /var/lib/cmpp-platform/object-storage
+
+install -m 0640 "$APP_DIR/deploy/security/cmpp-report-only.conf" /etc/fail2ban/action.d/cmpp-report-only.conf
+install -m 0640 "$APP_DIR/deploy/security/cmpp-http-scan.conf" /etc/fail2ban/filter.d/cmpp-http-scan.conf
+install -d -m 0750 /etc/nginx/snippets /etc/nftables.d
+touch /etc/nginx/snippets/cmpp-security-deny.conf
+chmod 0640 /etc/nginx/snippets/cmpp-security-deny.conf
+
+cat >/etc/nftables.d/cmpp-security.nft <<'EOF'
+table inet cmpp_security {
+  set blocked_ipv4 { type ipv4_addr; flags timeout; }
+  set blocked_ipv6 { type ipv6_addr; flags timeout; }
+  chain input { type filter hook input priority -10; policy accept; ip saddr @blocked_ipv4 drop; ip6 saddr @blocked_ipv6 drop; }
+}
+EOF
+grep -q 'cmpp-security.nft' /etc/nftables.conf || printf '\ninclude "/etc/nftables.d/cmpp-security.nft"\n' >>/etc/nftables.conf
+nft -c -f /etc/nftables.conf
+nft list table inet cmpp_security >/dev/null 2>&1 || nft -f /etc/nftables.d/cmpp-security.nft
+
+sed "s#/opt/cmpp-platform/current#$APP_DIR#g" "$APP_DIR/deploy/security/cmpp-security-agent.service" >/etc/systemd/system/cmpp-security-agent.service
+install -d -m 0755 /etc/systemd/system/cmpp-api.service.d
+cat >/etc/systemd/system/cmpp-api.service.d/security-boundary.conf <<EOF
+[Service]
+User=cmpp-api
+Group=cmpp-security
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=true
+ReadWritePaths=$APP_DIR/logs/api /var/lib/cmpp-platform/object-storage
+EOF
+
+fail2ban-client -t
+nginx -t
+systemctl daemon-reload
+systemctl enable cmpp-security-agent
+echo "Security boundary installed. Restart cmpp-security-agent and cmpp-api only in the approved release window."