ChiefGyk
8f4941a3c5
removed optional GeoIP and Tor exit node blocking. Can be readded if need be later, or by using the root project
2016-07-02 18:34:34 -04:00
ChiefGyk
5abc9c3ec5
added MaxMind, StopForumSpam, and Greensnow addresses to ipset lists.
2016-07-02 18:29:07 -04:00
ChiefGyk
6556da1e65
removed geoblocks, made tor exit node blocking optional during setup via yes/no dialog which will comment out the appropriate line in /etc/cron.daily/blacklist. Rearranged some code, deleted some files and clutter.
2016-06-30 08:20:47 -04:00
ChiefGyk
52410106e9
replaced iptables-persistent with another iptables-persistent in /etc/init.d, this one also will save ipsets and allow persistence upon reboot. Cleaned up some code, changed debconf variables at iptables-persistent install to false. Still installs iptable-persistant through apt, just to get rid of all the foundation work for it to run, but is quickly replaced.
2016-06-29 21:35:37 -04:00
ChiefGyk
9b3a158b72
Added Dshield, to automatically block the top 20 malicious IP blocks each day. It is merged into blacklist which will run in cron.daily. So ipset blocks the majority of addresses from lists, and IPTables does the blocks.
2016-06-29 18:33:09 -04:00
ChiefGyk
61780b8ae7
added optional geoblock lists that update weekly for China, and Korea as they create a lot of spam. They are added via IPtables as they are added in blocks.
2016-06-29 15:39:41 -04:00
ChiefGyk
8efe6c933f
added Malware Domain list and ZeusTracker
2016-06-29 14:18:43 -04:00
ChiefGyk
162f580e68
moved the comments around so it looked nicer on my other computer
2016-06-29 12:34:17 -04:00
ChiefGyk
324f5666f2
removed an unneeded line
2016-06-29 12:31:59 -04:00
ChiefGyk
1edd94ba39
added persistence by adding a couple lines to /etc/network/interfaces. It will automatically load at start, save each time the cron.daily runs, so if you need to reboot the ipset is loaded again.
2016-06-29 11:14:03 -04:00
ChiefGyk
ef5f90e02c
changed name from blocklist to blacklist to keep more uniform
2016-06-29 09:38:08 -04:00
ChiefGyk
39644bd29e
Now using ipset, added more lists, resarched and looked around for how to script it better. Now all will be able to wget from wizcraft (blocked my VPS, but not local machine so I suspect IP blocks are blocked from them), however there seems to be a lot of overlap of the addresses so I don't think it will be an issue. Averages around ~47,000 IP addresses as opposed to the original couple thousand just from blocklist.de. Does not require Fail2Ban to work just iptables, and of course iptables-persistent to keep changes.
2016-06-29 09:32:16 -04:00
ChiefGyk
d52f11710c
fixed iptables-persistent saving in the cron.daily for sync-fail2ban
2016-06-28 16:02:43 -04:00
ChiefGyk
273078b03e
added IPTables persistence and for it to save changes
2016-06-28 15:38:11 -04:00
ChiefGyk
484c9f2dbe
blocklist added to upstream master of 0.18c
2016-06-28 13:00:21 -04:00
ChiefGyk
23f2b1688f
reset
2016-06-28 12:31:21 -04:00
ChiefGyk
3a1313144b
moved blocklist script locally within installation
2016-06-27 09:38:14 -04:00
ChiefGyk
406f991be3
fixed error in my script copying nginx-badbots
2016-06-27 09:30:01 -04:00
ChiefGyk
20bf710b28
removed some more clutter from jail.local
2016-06-27 09:21:29 -04:00
ChiefGyk
b76c9330c5
some fixes to fail2ban filters and jail.local
2016-06-27 04:13:56 -04:00
ChiefGyk
3701676304
fixed miab-munin.conf
2016-06-27 04:01:51 -04:00
ChiefGyk
187b28dc51
committed a fix for owncloud filter. Lack of caffeine caused me to enter a wrong part of my script
2016-06-27 03:58:30 -04:00
ChiefGyk
cb35e6dd96
extended owncloud filter find time
2016-06-26 20:06:53 -04:00
ChiefGyk
fd457e187c
fixed some issues with warnings due to there not being a variable set for PKGMG=DPKG
2016-06-26 19:53:30 -04:00
ChiefGyk
ab3fbad0b8
a couple minor changes to Fail2Ban #870 fixed a couple variables, copied owncloud.conf fail2ban from my own owncloud 9 server for my own business. Though it is commented out
2016-06-26 13:37:21 -04:00
ChiefGyk
4f4ec5436a
added RKHunter to system.sh on lines 122-134 per #869 and made it run everytime apt launches to install or update. This should help prevent rootkits. I also added a config to whitelist certain things
2016-06-26 12:44:39 -04:00
ChiefGyk
6f1315f93a
added missing log location for jail.local
2016-06-26 11:03:30 -04:00
ChiefGyk
3b1b70ed16
added Fail2ban filters from #866 , #767 , and #798 on main branch
2016-06-26 10:57:59 -04:00
Chris Blankenship
fac8477ba1
Configured Dovecot to log into its own logfile
2016-06-06 08:21:44 -04:00
Joshua Tauberer
6d259a6e12
use "127.0.0.1" throughout rather than mixing use of an IP address and "localhost"
...
On some machines localhost is defined as something other than 127.0.0.1, and if we mix "127.0.0.1" and "localhost" then some connections won't be to to the address a service is actually running on.
This was the case with DKIM: It was running on "localhost" but Postfix was connecting to it at 127.0.0.1. (https://discourse.mailinabox.email/t/opendkim-is-not-running-port-8891/1188/12 .)
I suppose "localhost" could be an alias to an IPv6 address? We don't really want local services binding on IPv6, so use "127.0.0.1" to be explicit and don't use "localhost" to be sure we get an IPv4 address.
Fixes #797
2016-05-06 09:10:38 -04:00
Joshua Tauberer
30c89be982
merge #771 - stop fail2ban recidive emails
...
The emails were not deliverable anyway.
2016-04-06 19:03:44 -04:00
Tibor Blaho
c5e8a975cd
Fix denied ownCloud nginx locations
2016-03-31 00:07:48 +02:00
Michael Kroes
4d7229ccb0
Add documentation on why the notification was removed from the recidive jail
2016-03-26 13:37:33 +01:00
Michael Kroes
454a2b167b
Stop fail2ban recidive from sending emails, like all other jails
2016-03-26 09:04:51 +01:00
Michael Kroes
44705a32b7
Never allow admin panel to be inside a frame, use both modern and old headers. Also set no content sniffing
2016-03-13 18:40:02 +01:00
Michael Kroes
e343061cf4
Prevent clickjacking of management interface
2016-03-13 18:23:10 +01:00
Joshua Tauberer
8ea42847da
nightly status checks could fail if any domains had non-ASCII characters
...
https://discourse.mailinabox.email/t/status-check-emails-empty-after-upgrading-to-v0-16/1082/3
A user on that thread suggests an alternate solution, adding `PYTHONIOENCODING=utf-8` to `/etc/environment`. Python docs say that affects stdin/out/err. But we also use these environment variables elsewhere to ensure that config files we read/write are opened with UTF8 too. Maybe all that can be simplified too.
2016-02-13 11:51:06 -05:00
Joshua Tauberer
07f9228694
Merge branch 'letsencrypt' for automatic provisioning of TLS certificates from Let's Encrypt
2016-01-09 08:58:35 -05:00
Bernard `Guyzmo` Pratz
b09cbb0ca4
Fixing issue making it impossible to send mail from Z-Push
...
* added IMAP_SMTP_METHOD to z_push/backend_imap
* reverting that line accidentally deleted in commit 5055ef
* cf pull request GH-580 that commit is part of
Signed-off-by: Bernard `Guyzmo` Pratz <guyzmo+github@m0g.net>
2016-01-08 16:43:09 +00:00
Joshua Tauberer
4b4f670adf
s/SSL/TLS/ in user-visible text throughout the project
2016-01-04 18:43:16 -05:00
Joshua Tauberer
b6933a73fa
provision and install free SSL certificates from Let's Encrypt
2016-01-04 18:43:16 -05:00
Joshua Tauberer
bc79319864
Merge pull request #494 from anoma/fail2ban-recidive
...
Activate FAIL2BAN recidive jail
2015-12-22 08:11:19 -05:00
Joshua Tauberer
20e11bbab3
fail2ban: whitelist our machine's public ip address so status checks dont cause bans of the machine itself
2015-12-07 08:45:59 -05:00
Joshua Tauberer
4995cebc38
add additional comments explaining why the IMAP special folders are set up as they are
2015-11-01 07:30:15 -05:00
Michael Kroes
9b1e04b1e8
Merge remote-tracking branch 'upstream/master' into z-push-update
2015-10-31 03:08:54 -04:00
Michael Kroes
90836eff5b
For a new user create the archive folder
2015-10-27 02:20:00 -04:00
Michael Kroes
914cf68651
Remove default comments from imap config
2015-10-25 13:26:38 -04:00
Michael Kroes
4db82d3d09
Caldav doesnt support sync tokens
2015-10-25 13:19:22 -04:00
Michael Kroes
5055ef060d
Change configuration options for new version of z-push
2015-10-25 08:29:57 -04:00
Joshua Tauberer
f046031b26
nginx-ssl.conf changes were partially incorrect, partial revert of 834c42bc50
...
My own /etc/nginx/nginx.conf was messed up, so what I thought were Ubuntu 14.04 defaults weren't, and we lost the ssl_protocols and ssl_prefer_server_ciphers settings. This puts those back.
https://discourse.mailinabox.email/t/dev-master-version-reported-as-poodle-attack-vulnerable-by-ssllabs/898
2015-10-24 11:36:18 +00:00
