summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorJoey Hess2015-11-30 13:34:18 -0400
committerJoey Hess2015-11-30 13:34:18 -0400
commitd6d63ff095e6584e5a28eb39139f1cd7e83534d3 (patch)
tree5f6f4a94f4f73825d4c08cfc5ff252e6416445d5 /src
parent703c08cd618ec3d0f299b1f715e0ebfb7233ea09 (diff)
parentb82390983dd285e18df43c979d909331f44a01da (diff)
Merge branch 'joeyconfig'
Diffstat (limited to 'src')
-rw-r--r--src/Propellor/Property/Fail2Ban.hs30
-rw-r--r--src/Propellor/Property/Postfix.hs5
-rw-r--r--src/Propellor/Property/SiteSpecific/JoeySites.hs3
3 files changed, 38 insertions, 0 deletions
diff --git a/src/Propellor/Property/Fail2Ban.hs b/src/Propellor/Property/Fail2Ban.hs
new file mode 100644
index 00000000..716d376f
--- /dev/null
+++ b/src/Propellor/Property/Fail2Ban.hs
@@ -0,0 +1,30 @@
+module Propellor.Property.Fail2Ban where
+
+import Propellor.Base
+import qualified Propellor.Property.Apt as Apt
+import qualified Propellor.Property.Service as Service
+import Propellor.Property.ConfFile
+
+installed :: Property NoInfo
+installed = Apt.serviceInstalledRunning "fail2ban"
+
+reloaded :: Property NoInfo
+reloaded = Service.reloaded "fail2ban"
+
+type Jail = String
+
+-- | By default, fail2ban only enables the ssh jail, but many others
+-- are available to be enabled, for example "postfix-sasl"
+jailEnabled :: Jail -> Property NoInfo
+jailEnabled name = jailConfigured name "enabled" "true"
+ `onChange` reloaded
+
+-- | Configures a jail. For example:
+--
+-- > jailConfigured "sshd" "port" "2222"
+jailConfigured :: Jail -> IniKey -> String -> Property NoInfo
+jailConfigured name key value =
+ jailConfFile name `containsIniSetting` (name, key, value)
+
+jailConfFile :: Jail -> FilePath
+jailConfFile name = "/etc/fail2ban/jail.d/" ++ name ++ ".conf"
diff --git a/src/Propellor/Property/Postfix.hs b/src/Propellor/Property/Postfix.hs
index 20492dc6..356a945f 100644
--- a/src/Propellor/Property/Postfix.hs
+++ b/src/Propellor/Property/Postfix.hs
@@ -134,6 +134,11 @@ dedupCf ls =
-- Does not configure postfix to use it; eg @smtpd_sasl_auth_enable = yes@
-- needs to be set to enable use. See
-- <https://wiki.debian.org/PostfixAndSASL>.
+--
+-- Password brute force attacks are possible when SASL auth is enabled.
+-- It would be wise to enable fail2ban, for example:
+--
+-- > Fail2Ban.jailEnabled "postfix-sasl"
saslAuthdInstalled :: Property NoInfo
saslAuthdInstalled = setupdaemon
`requires` Service.running "saslauthd"
diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs
index 2e34d75f..ff92bf2d 100644
--- a/src/Propellor/Property/SiteSpecific/JoeySites.hs
+++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs
@@ -17,6 +17,7 @@ import qualified Propellor.Property.Obnam as Obnam
import qualified Propellor.Property.Apache as Apache
import qualified Propellor.Property.Postfix as Postfix
import qualified Propellor.Property.Systemd as Systemd
+import qualified Propellor.Property.Fail2Ban as Fail2Ban
import Utility.FileMode
import Data.List
@@ -541,6 +542,8 @@ kiteMailServer = propertyList "kitenet.net mail server" $ props
& dkimInstalled
& Postfix.saslAuthdInstalled
+ & Fail2Ban.installed
+ & Fail2Ban.jailEnabled "postfix-sasl"
& "/etc/default/saslauthd" `File.containsLine` "MECHANISMS=sasldb"
& Postfix.saslPasswdSet "kitenet.net" (User "errol")