From 45e358711989b0a0f733a0ef73334693c5e2670b Mon Sep 17 00:00:00 2001 From: buildplan Date: Sat, 8 Aug 2026 23:19:09 +0100 Subject: [PATCH 1/3] feat: switch fail2Ban banaction to ipset, update UFW SSH rules to limit --- du_setup.sh | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/du_setup.sh b/du_setup.sh index a1d6297..b21bf98 100644 --- a/du_setup.sh +++ b/du_setup.sh @@ -1,8 +1,10 @@ #!/bin/bash # Debian and Ubuntu Server Hardening Interactive Script -# Version: 0.81.1 | 2026-07-05 +# Version: 0.81.2 | 2026-08-08 # Changelog: +# - v0.81.2: Switch Fail2Ban UFW banaction to ipset for improved performance when handling large ban lists. +# Update UFW SSH rule from allow to limit to provide native brute-force protection. # - v0.81.1: Fix IPv6 connectivity issues with Secure DNS. # Implement Docker-compatible IPv6 SLAAC sysctl configuration and enable native IPv6 networking in Docker daemon. # - v0.81.0: Added optional encrypted DNS (DoT) setup using Quad9 and Cloudflare. @@ -280,7 +282,7 @@ print_header() { printf '%s\n' "${CYAN}╔═════════════════════════════════════════════════════════════════╗${NC}" printf '%s\n' "${CYAN}║ ║${NC}" printf '%s\n' "${CYAN}║ DEBIAN/UBUNTU SERVER SETUP AND HARDENING SCRIPT ║${NC}" - printf '%s\n' "${CYAN}║ v0.81.1 | 2026-07-05 ║${NC}" + printf '%s\n' "${CYAN}║ v0.81.2 | 2026-08-08 ║${NC}" printf '%s\n' "${CYAN}║ ║${NC}" printf '%s\n' "${CYAN}╚═════════════════════════════════════════════════════════════════╝${NC}" printf '\n' @@ -3340,8 +3342,9 @@ cleanup_and_exit() { print_error "An error occurred. Rolling back SSH changes to port $PREVIOUS_SSH_PORT..." print_info "Rolling back firewall rules..." ufw delete allow "$SSH_PORT"/tcp 2>/dev/null || true + ufw delete limit "$SSH_PORT"/tcp 2>/dev/null || true if [[ -n "$PREVIOUS_SSH_PORT" ]]; then - ufw allow "$PREVIOUS_SSH_PORT"/tcp comment 'SSH Rollback' 2>/dev/null || true + ufw limit "$PREVIOUS_SSH_PORT"/tcp comment 'SSH Rollback' 2>/dev/null || true print_info "Firewall rolled back to allow port $PREVIOUS_SSH_PORT." else print_warning "Could not determine previous SSH port for firewall rollback." @@ -3563,6 +3566,7 @@ EOF # Remove temporary UFW rule print_info "Removing temporary UFW rule for old SSH port $PREVIOUS_SSH_PORT..." ufw delete allow "$PREVIOUS_SSH_PORT"/tcp 2>/dev/null || true + ufw delete limit "$PREVIOUS_SSH_PORT"/tcp 2>/dev/null || true break else (( retry_count++ )) @@ -3948,7 +3952,7 @@ configure_firewall() { fi if ! ufw status | grep -qw "$SSH_PORT/tcp"; then print_info "Adding SSH rule for port $SSH_PORT..." - ufw allow "$SSH_PORT"/tcp comment 'Custom SSH' + ufw limit "$SSH_PORT"/tcp comment 'Custom SSH' else print_info "SSH rule for port $SSH_PORT already exists." fi @@ -4039,7 +4043,7 @@ configure_firewall() { if [[ -n "$PREVIOUS_SSH_PORT" && "$PREVIOUS_SSH_PORT" != "$SSH_PORT" ]]; then print_info "Temporarily adding UFW rule for current SSH port $PREVIOUS_SSH_PORT for transition..." if ! ufw status | grep -qw "$PREVIOUS_SSH_PORT/tcp"; then - ufw allow "$PREVIOUS_SSH_PORT"/tcp comment 'Temporary SSH for transition' + ufw limit "$PREVIOUS_SSH_PORT"/tcp comment 'Temporary SSH for transition' fi fi print_info "Enabling firewall..." @@ -4062,10 +4066,10 @@ configure_fail2ban() { print_section "Fail2Ban Configuration" # Install Fail2Ban if not present - if ! dpkg -l fail2ban | grep -q ^ii; then - print_info "Installing Fail2Ban..." - if ! apt-get install -y -qq fail2ban; then - print_error "Failed to install Fail2Ban." + if ! dpkg -l fail2ban | grep -q ^ii || ! dpkg -l ipset | grep -q ^ii; then + print_info "Installing Fail2Ban and ipset..." + if ! apt-get install -y -qq fail2ban ipset; then + print_error "Failed to install Fail2Ban or ipset." return 1 fi fi @@ -4181,7 +4185,7 @@ ignoreip = ${IGNORE_IPS[*]} bantime = 1d findtime = 10m maxretry = 5 -banaction = ufw +banaction = iptables-ipset-proto6-allports [sshd] enabled = true @@ -6169,6 +6173,7 @@ generate_summary() { # Adjust verification commands based on selection if [[ "$IDS_INSTALLED" == "fail2ban" ]]; then printf " %-28s ${CYAN}%s${NC}\n" "- Fail2Ban sshd jail:" "sudo fail2ban-client status sshd" + printf " %-28s ${CYAN}%s${NC}\n" "- IPSet banned IPs:" "sudo ipset list" elif [[ "$IDS_INSTALLED" == "crowdsec" ]]; then printf " %-28s ${CYAN}%s${NC}\n" "- CrowdSec status:" "sudo cscli metrics" printf " %-28s ${CYAN}%s${NC}\n" "- CrowdSec bans:" "sudo cscli decisions list" From 4b5d3311221ed5e5144fe5c1ac1eae2175d27b2b Mon Sep 17 00:00:00 2001 From: buildplan Date: Sat, 8 Aug 2026 23:20:03 +0100 Subject: [PATCH 2/3] checksum v0.81.2 --- du_setup.sh.sha256 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/du_setup.sh.sha256 b/du_setup.sh.sha256 index 6764579..c78b9a4 100644 --- a/du_setup.sh.sha256 +++ b/du_setup.sh.sha256 @@ -1 +1 @@ -4f8bfcba752ff65423f45b7dd020b4a2b21080ff916c68e276e4d9f3a1f82e9a du_setup.sh +61e57d5dda80143be646ac1777095b4e658a980ab88dfde6756a965eb8af65e9 du_setup.sh From b7486bb474fde4aed9de875840d8f5e757244734 Mon Sep 17 00:00:00 2001 From: buildplan Date: Sat, 8 Aug 2026 23:22:53 +0100 Subject: [PATCH 3/3] chore: update version and checksum --- README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 710f87f..d831075 100644 --- a/README.md +++ b/README.md @@ -7,9 +7,9 @@ ----- -**Version:** v0.81.1 +**Version:** v0.81.2 -**Last Updated:** 2026-07-05 +**Last Updated:** 2026-08-08 **Compatible With:** @@ -88,12 +88,12 @@ sha256sum du_setup.sh Compare the output hash to the one below. They must match exactly. -`4f8bfcba752ff65423f45b7dd020b4a2b21080ff916c68e276e4d9f3a1f82e9a` +`61e57d5dda80143be646ac1777095b4e658a980ab88dfde6756a965eb8af65e9` Or echo the hash to check, it should output: `du_setup.sh: OK` ```bash -echo 4f8bfcba752ff65423f45b7dd020b4a2b21080ff916c68e276e4d9f3a1f82e9a du_setup.sh | sha256sum --check +echo 61e57d5dda80143be646ac1777095b4e658a980ab88dfde6756a965eb8af65e9 du_setup.sh | sha256sum --check ``` ### 3. Run the Script