Merge pull request #12 from balena-os/kyle/fail2ban

Run fail2ban service sidecar with sshd jail

docker-compose.yml

@@ -13,8 +13,25 @@ services:
       - home:/home
       - docker:/var/lib/docker
       - ssh:/etc/ssh
+      - shared:/shared
+
+  fail2ban:
+    build: fail2ban
+    network_mode: host
+    cap_add:
+      - NET_ADMIN
+      - NET_RAW
+    volumes:
+      - fail2ban:/data
+      - shared:/shared:ro
+    environment:
+      F2B_LOG_TARGET: STDOUT
+      F2B_LOG_LEVEL: INFO
+      F2B_DB_PURGE_AGE: 1d
 
 volumes:
   home: {}
   docker: {}
   ssh: {}
+  shared: {}
+  fail2ban: {}

fail2ban/Dockerfile

@@ -0,0 +1,3 @@
+FROM crazymax/fail2ban:1.0.2
+
+COPY jail.d/ /data/jail.d/

fail2ban/jail.d/sshd.conf

@@ -0,0 +1,9 @@
+[sshd]
+enabled = true
+chain = INPUT
+port = ssh
+filter = sshd[mode=aggressive]
+logpath = /shared/logs/sshd.log
+# datepattern = ^+%b %d %H:%M:%S
+maxretry = 5
+bantime = 1h

yocto-build-env/s6-overlay/s6-rc.d/sshd/run

@@ -5,16 +5,22 @@ set -euo pipefail
 [[ ${VERBOSE:-,,} =~ true|yes|on|1 ]] && set -x
 
 mkdir -p /run/sshd
+mkdir -p /shared/logs
 
 ssh-keygen -A
 
-# run sshd in the foreground
-/usr/sbin/sshd -De \
+# run sshd in the foreground and format the logs such
+# that fail2ban can parse them
+exec /usr/sbin/sshd -De \
     -o "LogLevel=${SSHD_LOG_LEVEL:-INFO}" \
     -o PermitRootLogin=no \
     -o PasswordAuthentication=no \
     -o PubkeyAuthentication=yes \
     -o UsePAM=yes \
     -o AcceptEnv="LANG LC_*" \
     -o PrintMotd=no \
-    -o Banner=none
+    -o Banner=none \
+    2>&1 |
+    while IFS= read -r line; do
+        echo "$(date '+%b %d %H:%M:%S') $HOSTNAME sshd[$$]: $line"
+    done | tee /shared/logs/sshd.log