certbot

  1. https://certbot.eff.org/instructions?ws=nginx&os=debianbuster
  2. include snippets/letsencrypt-acme-challenge.conf;
  3. certbot --nginx --expand --redirect  --cert-name bubuit.net -d DOM.TLD,SUBDOM.DOM.TLD
    1. # KEIN ABSTAND KOMMA

 

Tags
certbot
security

dnsbl-ipset

  1. https://github.com/firehol/firehol/wiki/dnsbl-ipset.sh
  2. /usr/share/doc/firehol-tools/examples/contrib/dnsbl-ipset.sh

/etc/firehol/firehol.conf

ipset4 create dnsbl hash:ip timeout $[86400 * 14] maxelem 500000 prevent_reset_on_restart comment 
action4 AUDIT_ACCEPT \ 
action ACCEPT state NEW log "AUDIT" \ 
next action ACCEPT 
blacklist4 full inface "${wan}" ipset:dnsbl \ 
except src ipset:whitelist

leider waren auch

Tags
security
dns
firewall

E-Mail IP-Stripping aus Datenschutzgründen

/etc/postfix/header_cleanup_outgoing

/^\s*(Received: from)[^\n]*(.*)/ REPLACE $1 127.0.0.1 (localhost [127.0.0.1])$2
/^\s*User-Agent/ IGNORE
/^\s*X-Enigmail/ IGNORE
/^\s*X-Mailer/ IGNORE
/^\s*X-Originating-IP/ IGNORE
/^\s*Mime-Version/ IGNORE

/etc/postfix/main.cf

smtp_header_checks = pcre:/etc/postfix/header_cleanup_outgoing

  1. chmod 600 /etc/postfix/header_cleanup_outgoing

Tags
security
postfix

ipset

  1. ai firehol-tools
  2. ll -t /etc/firehol/ipsets
  3. update-ipsets enable firehol_level1 firehol_level2 firehol_level3 firehol_level4 fullbogons spamhaus_drop sslbl blocklist_de greensnow ciarmy sslbl_aggressive 
  4. update-ipsets
  5. ipset -L -n
  6. ipset -L firehol_level1
  7. t /var/log/update-ipsets.log
  8. update-ipsets --help
  9. man ipset

/etc/cron.daily/update-ipsets

#!/bin/sh
update-ipsets -s > /var/log/update-ipsets.log 2>&1
 

Tags
firewall
security

fail2ban statistics

  1. ai mailutils
  2. https://www.abuseipdb.com/ 
  3. https://www.liveipmap.com/ 

/etc/cron.monthly/f2b-stat

#!/bin/sh

Tags
analytics
security
firewall

nmap

  1. https://www.cyberciti.biz/faq/install-nmap-debian-ubuntu-server-desktop-system/
Tags
security

DDoS protection: SYNPROXY

/etc/firehol/firehol.conf

# SYNPROXY
TRAP_PORTS="25 80"
SUSPECTS_TIMEOUT=3600
TRAP_TIMEOUT=86400
VALID_CONNECTION_COUNT=2
TRAP_ACTION="DROP"

ipv4 synproxy input inface "${wan}" dst "${PUBLIC_IPS}" dport "${TRAP_PORTS}" accept

Tags
firewall
security
SYNPROXY

Hetzner Firewall

https://robot.hetzner.com/server

https://docs.hetzner.com/robot/dedicated-server/firewall/

Tags
hetzner
security
fw rules