Add Fail2ban support #65

lapineige · 2019-04-24T09:10:13Z

Problem

Wallabag is not protected by fail2ban against brute force
See Set-up fail2ban rules #37

Solution

Add fail2ban config.

The number of retry is set to 5, I think it allows users to make a reasonable number of errors while restricting brute force possibilities.

Warning : this PR will drop support for version older than 3.5, in particular Yunohost 2.7 (Debian 8).

PR Status

Validation

Minor decision

Upgrade previous version :
Code review : Maniack C
Approval (LGTM) : Maniack C
Approval (LGTM) : JimboJoe
CI succeeded :

When the PR is marked as ready to merge, you have to wait for 3 days before really merging it.

Testing

It's always nice to have a quick look at the UI of the software you're going to install :)

* Fix 413 request entity too large (#55) * [fix] 413 Request Entity Too Large * Remove ini file for php (#57) Have a look to YunoHost-Apps/nextcloud_ynh#138 for more information

To make sure any older version will get fail2ban support

This is needed for fail2ban helpers

lapineige · 2019-04-24T09:19:34Z

Changed the base branch to master, as it is an high priority issue, we can't wait for testing to be merged.

lapineige · 2019-04-24T10:13:48Z

I fixed the regex conf, at first I did not understand how to configure it correctly.

I tried a fresh install + removal, it works. Fail2ban seems to be active: after 5 failed login attempts, the login page doesn't load.

It's ready for review.

scripts/remove

scripts/restore

maniackcrudelis · 2019-04-27T22:29:00Z

Adding fail2ban is a good improvement, not a security issue needed to be quickly fixed.

maniackcrudelis · 2019-04-28T21:28:20Z

There https://ci-apps-hq.yunohost.org/jenkins/job/wallabag2_ynh%20PR65/5/console

lapineige · 2019-05-01T09:05:42Z

Ok, only upgrade from this version fails…

I found the issue: I fixed the regex syntax in the install script, but not in the upgrade one
Should be fixed now.

This allow empty username (not possible, but may still block some extra brute force spammers) and username with spaces

JimboJoe · 2019-05-04T13:37:52Z

Upgrade is stille failing on the CI.

Warning: yunohost.hook <lambda> - [3344.1] Job for fail2ban.service failed because the control process exited with error code.
Warning: yunohost.hook <lambda> - [3344.1] See "systemctl status fail2ban.service" and "journalctl -xe" for details.
Warning: yunohost.hook <lambda> - [3344.1] !!
Warning: yunohost.hook <lambda> - [3344.1]   wallabag2's script has encountered an error. Its execution was cancelled.
Warning: yunohost.hook <lambda> - [3344.1] !!
Warning: yunohost.hook <lambda> - [3344.1] ./upgrade: line 61: ynh_backup_after_failed_upgrade: command not found

lapineige · 2019-05-04T13:44:51Z

But we don't have the log for fail2ban… :(

JimboJoe · 2019-05-04T13:54:56Z

Isn't the problem reproducible with package_check in your environment?

lapineige · 2019-05-04T17:04:09Z

How do I use it ?

JimboJoe · 2019-05-04T17:08:24Z

As an app maintainer, you will love package_check! Have a look at the README, you can install it on your test server/VM. It's been developed mainly by @maniackcrudelis, and it's what produces the results of the CI.

lapineige · 2019-05-04T17:13:11Z

I don't have any VM or test server for that :/

JimboJoe · 2019-05-04T17:17:04Z

Then you'll be interested by this forum post 😉

lapineige · 2019-05-04T17:50:48Z

Ok, I tried again on my main server (backup + remove old wallabag + install master + upgrade to this branch), the error is:

No file(s) found for glob /var/www/wallabag2/var/logs/prod.log

I fixed that in the install script, but not in the upgrade script 😅
I'll do it.

JimboJoe · 2019-05-05T09:40:11Z

By the way, more relevant link here to use the CI available for app packagers 😉

lapineige · 2019-05-05T09:43:13Z

CI is succeeding right now.

Let's merge ?

JimboJoe

LGTM 👍

JimboJoe · 2019-05-05T10:00:21Z

Can be merged in 3 days (if @maniackcrudelis confirms his code review after late changes)

JimboJoe · 2019-05-05T11:30:33Z

Can be merged in 3 days.

lapineige · 2019-05-05T12:41:59Z

Thanks @maniackcrudelis for the improvements :)

maniackcrudelis and others added 11 commits July 7, 2018 12:43

Merge pull request #54 from YunoHost-Apps/testing

5ea515c

Testing

Readme: Add welcome UI screenshoot

ea237f1

It's always nice to have a quick look at the UI of the software you're going to install :)

Testing (#56)

06be7ae

* Fix 413 request entity too large (#55) * [fix] 413 Request Entity Too Large * Remove ini file for php (#57) Have a look to YunoHost-Apps/nextcloud_ynh#138 for more information

Add fail2ban config

96aab13

Add Fail2ban config removal helper

55d09a4

Enhance fail2ban config look

fc17df7

Add fail2ban backup

e75462e

Restore fail2ban config

32c04b1

Add fail2ban config during upgrade

1ae54d4

To make sure any older version will get fail2ban support

Update minimum version to 3.5

37a4914

This is needed for fail2ban helpers

Add fail2ban info

431e78f

lapineige requested review from JimboJoe and maniackcrudelis and removed request for JimboJoe April 24, 2019 09:10

lapineige changed the base branch from testing to master April 24, 2019 09:11

lapineige mentioned this pull request Apr 24, 2019

Add Fail2Ban app config #66

Open

lapineige added 3 commits April 24, 2019 11:23

Fail2ban: Fix missing log file during install

66fcc20

Fix feil2ban regex

6810f6d

Fix fail2ban regex - 2

ef9af44

lapineige added enhancement security labels Apr 24, 2019

maniackcrudelis changed the base branch from master to testing April 27, 2019 22:24

maniackcrudelis reviewed Apr 27, 2019

View reviewed changes

scripts/remove Outdated Show resolved Hide resolved

maniackcrudelis reviewed Apr 27, 2019

View reviewed changes

scripts/restore Outdated Show resolved Hide resolved

maniackcrudelis removed the security label Apr 27, 2019

Use ynh_systemd_action

cbd245e

Fix fail2ban regex in upgrade script

e232b25

lapineige dismissed maniackcrudelis’s stale review via e232b25 May 1, 2019 09:04

lapineige requested a review from maniackcrudelis May 1, 2019 09:08

lapineige added 2 commits May 1, 2019 11:11

Improve regex - install

de6ddbb

This allow empty username (not possible, but may still block some extra brute force spammers) and username with spaces

Improve regex - upgrade

f08fe78

This allow empty username (not possible, but may still block some extra brute force spammers) and username with spaces

Fix missing log file for fail2ban

d492a24

JimboJoe previously approved these changes May 5, 2019

View reviewed changes

JimboJoe mentioned this pull request May 5, 2019

Update to 2.3.7 #61

Merged

8 tasks

Indentation and variable usage

6d99fa2

maniackcrudelis dismissed JimboJoe’s stale review via 6d99fa2 May 5, 2019 11:28

maniackcrudelis approved these changes May 5, 2019

View reviewed changes

JimboJoe approved these changes May 5, 2019

View reviewed changes

lapineige merged commit ae76c98 into testing May 8, 2019

lapineige deleted the fail2ban branch May 8, 2019 15:25

maniackcrudelis mentioned this pull request May 13, 2019

Testing #70

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Fail2ban support #65

Add Fail2ban support #65

lapineige commented Apr 24, 2019 •

edited by JimboJoe

Loading

lapineige commented Apr 24, 2019

lapineige commented Apr 24, 2019

maniackcrudelis commented Apr 27, 2019

maniackcrudelis commented Apr 28, 2019

lapineige commented May 1, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 5, 2019

lapineige commented May 5, 2019

JimboJoe left a comment

JimboJoe commented May 5, 2019

JimboJoe commented May 5, 2019

lapineige commented May 5, 2019

Add Fail2ban support #65

Add Fail2ban support #65

Conversation

lapineige commented Apr 24, 2019 • edited by JimboJoe Loading

Problem

Solution

PR Status

Validation

lapineige commented Apr 24, 2019

lapineige commented Apr 24, 2019

maniackcrudelis commented Apr 27, 2019

maniackcrudelis commented Apr 28, 2019

lapineige commented May 1, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 4, 2019

lapineige commented May 4, 2019

JimboJoe commented May 5, 2019

lapineige commented May 5, 2019

JimboJoe left a comment

Choose a reason for hiding this comment

JimboJoe commented May 5, 2019

JimboJoe commented May 5, 2019

lapineige commented May 5, 2019

lapineige commented Apr 24, 2019 •

edited by JimboJoe

Loading