Firewall host & fail2ban belum ada (brute force mail/SSH) #3

New issue

Closed

opened 2026-10-11 06:57:52 +00:00 by reza · 1 comment

reza commented

2026-10-11 06:57:52 +00:00

Owner

Kondisi sekarang: port 22,25,465,587,993,995,4190 terbuka ke publik tanpa fail2ban; belum jelas ada nftables/ufw default-deny.

Risiko: brute force SSH/IMAP/SMTP, penyalahgunaan relay, banjir log.

Usulan:

nftables/ufw default-deny inbound, allow hanya port yang perlu.
fail2ban jail: sshd, postfix/stalwart, dovecot/IMAP.
Pertimbangkan CrowdSec untuk threat intel.

Selesai bila:

Firewall aktif & terdokumentasi
fail2ban jalan + teruji memblokir

**Kondisi sekarang:** port `22,25,465,587,993,995,4190` terbuka ke publik tanpa fail2ban; belum jelas ada nftables/ufw default-deny. **Risiko:** brute force SSH/IMAP/SMTP, penyalahgunaan relay, banjir log. **Usulan:** - nftables/ufw default-deny inbound, allow hanya port yang perlu. - fail2ban jail: `sshd`, `postfix`/`stalwart`, `dovecot`/IMAP. - Pertimbangkan CrowdSec untuk threat intel. **Selesai bila:** - [ ] Firewall aktif & terdokumentasi - [ ] fail2ban jalan + teruji memblokir

reza added the

area/security

priority/p0

labels

2026-10-11 06:57:52 +00:00

reza referenced this issue from a commit

2026-10-11 07:40:20 +00:00

feat: firewall host nftables + fail2ban (close #3)

reza closed this issue

2026-10-11 07:40:20 +00:00

reza commented

2026-10-11 07:40:44 +00:00

Author

Owner

Selesai ✅ — Firewall host + fail2ban aktif di produksi (commit 8e1749d).

Firewall nftables (/etc/nftables.conf, service nftables enabled):

Tabel inet bitbox_fw: INPUT default-deny; allow lo, established/related, ICMP, SSH 22, HTTP/HTTPS + HTTP/3 (80/443 tcp+udp), mail (25/465/587/993/995/4190), Forgejo SSH 2222, DNS container 10.89.0.0/24 → host:53.
FORWARD dipertahankan accept (+invalid drop) supaya networking podman/netavark tidak putus; flush ruleset dihapus agar reload nftables tidak menghapus tabel netavark.

fail2ban (backend systemd, ban via nftables, ignoreip 127.0.0.1/8 ::1 10.89.0.0/24):

sshd — brute force SSH host (sudah ada, ditambah ignoreip).
stalmail — baru: auth gagal SMTP/Submission/IMAPS/POP3S/Sieve dari journald (CONTAINER_NAME=stalwart); listener HTTP di-ignore karena via reverse proxy.
forgejologin — baru: gagal login web Forgejo.

Verifikasi:

Port scan ulang: 22/25/80/443/465/587/993/995/2222/4190 tetap terbuka (= baseline); 143/110/3000/5432/8080/8443/6379 tetap tertutup.
TLS handshake SMTPS/IMAPS/POP3S ✓ TLSv1.3, HTTP dev/auth/mail ✓ (200/308/307), egress container (google/aws) ✓ 200.
Regex jail diuji fail2ban-regex (stalmail 2/3 — benar mengecualikan listener http; forgejologin 2/2).

Konfigurasi terdokumentasi di repo: infra/firewall/nftables.conf, infra/fail2ban/ (filter + jail), install.sh (deploy otomatis), README §10.

Catatan follow-up:

container → dev.bitbox.id (hairpin NAT ke IP publik sendiri) gagal (000) — perilaku pra-eksis (jalur FORWARD, bukan INPUT; akses eksternal normal). Usulkan jadi issue baru bila perlu.
Tetap ingat rotasi kredensial yang pernah terekspos (issue #2), termasuk PAT Forgejo ini.

**Selesai ✅** — Firewall host + fail2ban aktif di produksi (commit `8e1749d`). **Firewall nftables** (`/etc/nftables.conf`, service `nftables` enabled): - Tabel `inet bitbox_fw`: INPUT **default-deny**; allow `lo`, established/related, ICMP, SSH 22, HTTP/HTTPS + HTTP/3 (80/443 tcp+udp), mail (25/465/587/993/995/4190), Forgejo SSH 2222, DNS container `10.89.0.0/24` → host:53. - FORWARD dipertahankan `accept` (+`invalid drop`) supaya networking podman/netavark tidak putus; `flush ruleset` dihapus agar reload nftables tidak menghapus tabel `netavark`. **fail2ban** (backend systemd, ban via nftables, `ignoreip 127.0.0.1/8 ::1 10.89.0.0/24`): - `sshd` — brute force SSH host (sudah ada, ditambah ignoreip). - `stalmail` — **baru**: auth gagal SMTP/Submission/IMAPS/POP3S/Sieve dari journald (`CONTAINER_NAME=stalwart`); listener HTTP di-ignore karena via reverse proxy. - `forgejologin` — **baru**: gagal login web Forgejo. **Verifikasi:** - Port scan ulang: 22/25/80/443/465/587/993/995/2222/4190 tetap terbuka (= baseline); 143/110/3000/5432/8080/8443/6379 tetap tertutup. - TLS handshake SMTPS/IMAPS/POP3S ✓ TLSv1.3, HTTP dev/auth/mail ✓ (200/308/307), egress container (google/aws) ✓ 200. - Regex jail diuji `fail2ban-regex` (stalmail 2/3 — benar mengecualikan listener http; forgejologin 2/2). **Konfigurasi terdokumentasi di repo:** `infra/firewall/nftables.conf`, `infra/fail2ban/` (filter + jail), `install.sh` (deploy otomatis), README §10. **Catatan follow-up:** - `container → dev.bitbox.id` (hairpin NAT ke IP publik sendiri) gagal (`000`) — perilaku pra-eksis (jalur FORWARD, bukan INPUT; akses eksternal normal). Usulkan jadi issue baru bila perlu. - Tetap ingat rotasi kredensial yang pernah terekspos (issue #2), termasuk PAT Forgejo ini.