Mirrors/ProxMenux
1
0
Fork 0
mirror of https://github.com/MacRimi/ProxMenux.git synced 2026-02-19 17:06:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update security_manager.py

Browse Source
This commit is contained in:
MacRimi
2026-02-10 19:32:49 +01:00
parent 59cc2741b8
commit c4b1820d08
1 changed files with 12 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
AppImage/scripts/security_manager.py
View File

@@ -788,12 +788,16 @@ def apply_missing_jails():
current_jails = [j.strip().lower() for j in jails_str.split(",") if j.strip()] current_jails = [j.strip().lower() for j in jails_str.split(",") if j.strip()]
# --- Proxmox jail (port 8006) --- # --- Proxmox jail (port 8006) ---
# Uses backend=systemd because Proxmox does not use rsyslog,
# so pvedaemon logs go to the systemd journal, not /var/log/daemon.log.
if "proxmox" not in current_jails: if "proxmox" not in current_jails:
try: try:
# Create filter # Create filter with journalmatch for systemd backend
filter_content = """[Definition] filter_content = """[Definition]
failregex = pvedaemon\\[.*authentication failure; rhost=<HOST> user=.* msg=.* failregex = pvedaemon\\[.*authentication (failure|error); rhost=<HOST> user=.* msg=.*
pvedaemon\\[.*\\]: authentication failure; rhost=<HOST>
ignoreregex = ignoreregex =
journalmatch = _COMM=pvedaemon
""" """
with open("/etc/fail2ban/filter.d/proxmox.conf", "w") as f: with open("/etc/fail2ban/filter.d/proxmox.conf", "w") as f:
f.write(filter_content) f.write(filter_content)
@@ -803,8 +807,7 @@ ignoreregex =
enabled = true enabled = true
port = 8006 port = 8006
filter = proxmox filter = proxmox
backend = auto backend = systemd
logpath = /var/log/daemon.log
maxretry = 3 maxretry = 3
bantime = 3600 bantime = 3600
findtime = 600 findtime = 600
@@ -817,12 +820,15 @@ findtime = 600
errors.append(f"proxmox: {str(e)}") errors.append(f"proxmox: {str(e)}")
# --- ProxMenux Monitor jail (port 8008 + reverse proxy) --- # --- ProxMenux Monitor jail (port 8008 + reverse proxy) ---
# Uses backend=auto with logpath because the Flask app writes
# auth failures directly to this file (not via syslog/journal).
if "proxmenux" not in current_jails: if "proxmenux" not in current_jails:
try: try:
# Create filter # Create filter with datepattern for Python logging format
filter_content = """[Definition] filter_content = """[Definition]
failregex = proxmenux-auth: authentication failure; rhost=<HOST> user=.* failregex = ^.*proxmenux-auth: authentication failure; rhost=<HOST> user=.*$
ignoreregex = ignoreregex =
datepattern = ^%%Y-%%m-%%d %%H:%%M:%%S
""" """
with open("/etc/fail2ban/filter.d/proxmenux.conf", "w") as f: with open("/etc/fail2ban/filter.d/proxmenux.conf", "w") as f:
f.write(filter_content) f.write(filter_content)