Fail2ban

Kontekst: https://github.com/CloudburstMC/Network/security/advisories/GHSA-6h3m-c6fv-8hvh

Selv om problemet ble patchet i GeyserMC blir konsollen allikevel flooda:

I et forsøk på å unngå dette er det forsøkt å satt opp fail2ban. Siden serveren kjører i docker må det tas ekstra hensyn, se https://tkaefer.de/blog/2021/12/07/follow-up-docker-and-fail2ban-how-i-solved-it-for-me/ - /etc/fail2ban/actions.d/iptables-mangle-allports-ipset.conf og /usr/local/bin/ipset-fail2ban.sh er hentet derfra.

Relevante filer

# /etc/fail2ban/filter.d/minecraft.comf
[Definition]
failregex = ^\[.*INFO\]: \[Geyser-Spigot\] \/<HOST>:.* tried to connect\!$
ignoreregex =

#/etc/fail2ban/jail.d/minecraft.conf
[minecraft]
enabled = true
findtime = 300
filter = minecraft
logpath = /home/gamer/minecraft-server/data/logs/latest.log
bantime = 4w
ignoreip = 192.168.10.0/24
protocol = udp
banaction = iptables-mangle-allports-ipset[name="minecraft"]

Kommandoer

fail2ban-client status minecraft