gelöst Rootserver mit Debian Bookworm *FULL ENCRYPTED* inkl. Firewall/fail2ban und OSCam

22.03.2025 - Spoiler entfernt
05.03.2025 - Command fix in Thema 1 - Schritt 25.1
03.03.2025 - Hinweis auf Festplattenbezeichnung hinzugefügt
01.03.2025 - Nano Editor Tipps hinzugefügt
28.02.2025 - Erste Version der Anleitung

# Debian Jessie (EOL) - Hauptrepositorys
deb http://archive.debian.org/debian/ jessie main contrib non-free
deb-src http://archive.debian.org/debian/ jessie main contrib non-free

# Debian Jessie Sicherheitsupdates (EOL)
deb http://archive.debian.org/debian-security jessie/updates main contrib non-free
deb-src http://archive.debian.org/debian-security jessie/updates main contrib non-free

# Debian Jessie Updates (EOL)
deb http://archive.debian.org/debian/ jessie-updates main contrib non-free
deb-src http://archive.debian.org/debian/ jessie-updates main contrib non-free

# Debian 9 (Stretch)
deb http://archive.debian.org/debian stretch main contrib non-free
deb-src http://archive.debian.org/debian stretch main contrib non-free

deb http://archive.debian.org/debian-security stretch/updates main contrib non-free
deb-src http://archive.debian.org/debian-security stretch/updates main contrib non-free

# Debian 10 (Buster)
deb http://deb.debian.org/debian buster main contrib non-free
deb-src http://deb.debian.org/debian buster main contrib non-free

deb http://security.debian.org/debian-security buster/updates main contrib non-free
deb-src http://security.debian.org/debian-security buster/updates main contrib non-free

# Debian 11 (Bullseye)
deb http://deb.debian.org/debian bullseye main contrib non-free
deb-src http://deb.debian.org/debian bullseye main contrib non-free

deb http://security.debian.org/debian-security bullseye-security main contrib non-free
deb-src http://security.debian.org/debian-security bullseye-security main contrib non-free

# Debian 12 (Bookworm)
deb http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware
deb-src http://deb.debian.org/debian bookworm main contrib non-free non-free-firmware

deb http://security.debian.org/debian-security bookworm-security main contrib non-free
deb-src http://security.debian.org/debian-security bookworm-security main contrib non-free

Feb 21 04:07:05 debian sshd[23103]: Invalid user tania from 23.176.184.113 port 60694
Feb 21 04:07:05 debian sshd[23103]: pam_unix(sshd:auth): check pass; user unknown
Feb 21 04:07:05 debian sshd[23103]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost>
Feb 21 04:07:07 debian sshd[23103]: Failed password for invalid user tania from 23.176.184.113 port 60694 ssh2
Feb 21 04:07:09 debian sshd[23103]: Received disconnect from 23.176.184.113 port 60694:11: Bye Bye [preauth]
Feb 21 04:07:09 debian sshd[23103]: Disconnected from invalid user tania 23.176.184.113 port 60694 [preauth]
Feb 21 04:07:21 debian sshd[23105]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost>
Feb 21 04:07:24 debian sshd[23105]: Failed password for root from 74.225.140.185 port 38234 ssh2
Feb 21 04:07:24 debian sshd[23105]: Received disconnect from 74.225.140.185 port 38234:11: Bye Bye [preauth]
Feb 21 04:07:24 debian sshd[23105]: Disconnected from authenticating user root 74.225.140.185 port 38234 [preauth]

#!/bin/bash
### BEGIN INIT INFO
# Provides:          firewall
# Required-Start:    $network $syslog
# Required-Stop:     $network $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Start/Stop firewall
# Description:       This script manages the firewall rules using iptables.
### END INIT INFO

iptables=$(which iptables)
iptablesv6=$(which ip6tables)
#User Definition mit Zugriffen auf spezielle Services
#user="user.dyndns.org,deinedyn.homedns.com"
#(Ist vor Block APNIC eingebaut!)
#sharepartner="bla.dyndns.org"

# function for logging
logit() {
    if [ -n "$1" ]; then
        ( while read -r line; do
            # output to terminal
            if [ -t 1 ]; then
                echo -e "${line}"
            fi
        done ) <<< "$1"
    else
        while read -r line; do
            # output to terminal
            if [ -t 1 ]; then
                echo -e "${line}"
            fi
        done
    fi
}

# wenn iptables nicht installiert, Fehlermeldung ausgeben und abbrechen
if [ -z "$iptables" ]; then
    logit "[Error] iptables is not installed or not in the PATH."
    exit 1
fi

# wenn iptablesv6 nicht installiert, Fehlermeldung ausgeben und abbrechen
if [ -z "$iptablesv6" ]; then
    logit "[Error] iptablesv6 is not installed or not in the PATH."
    exit 1
fi

case "$1" in
start)
logit "[+] Waiting 5 seconds..."
sleep 5
logit "[+] Starting firewall..."
# alle Regeln löschen
$iptables -t nat -F
$iptables -t filter -F
$iptables -X
#$iptablesv6 -t nat -F
$iptablesv6 -t filter -F
$iptablesv6 -X
$iptables -P INPUT DROP
$iptables -P FORWARD DROP
$iptablesv6 -P FORWARD DROP
$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo -j ACCEPT
$iptablesv6 -A INPUT -i lo -j ACCEPT
$iptablesv6 -A OUTPUT -o lo -j ACCEPT
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptablesv6 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#$iptablesv6 -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$iptables -P OUTPUT ACCEPT
$iptablesv6 -P OUTPUT ACCEPT

# OpenVPN
#$iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -d 10.20.30.40 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
#$iptables -A OUTPUT -p icmp --icmp-type 0 -s 10.20.30.40 -d 0/0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# SSH
$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport EuerPort -j ACCEPT

#Xtream-Codes
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport EuerPort -j ACCEPT

#OScam Webif
$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport EuerPort -j ACCEPT

#CCcam Share (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport EuerPort -j ACCEPT

#Cs378x Share (Port ggf. anpassen und zum aktivieren des Zugriffs # entfernen!)
$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -p tcp --dport EuerPort -j ACCEPT

#DROPS (unerwünschte IPs, von denen JEGLICHE Anfragen verworfen werden):
#$iptables -I INPUT --source <IP> -j DROP
#$iptables -I INPUT --source <IP> -j DROP

#Sharepartner Beispiel CE Port 1337
#$iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED --source $sharepartner -p tcp --dport 1337-j ACCEPT
#Jeder Sharepartner kann somit auf Port 1337 connecten.
#Willst du das es einer nicht mehr tut, dann einfach oben in der Variable den betroffenen Sharepartner entfernen!

#Block APNIC LACNIC
#Hinweis: Blockiert Asien, Südamerika, Mittelamerika, beschränkt Russland bzw. Osteuropa!
APNIC=(
        "1.0.0.0/8"
        "14.0.0.0/8"
        "27.0.0.0/8"
        "36.0.0.0/8"
        "39.0.0.0/8"
        "42.0.0.0/8"
        "43.0.0.0/8"
        "49.0.0.0/8"
        "58.0.0.0/8"
        "59.0.0.0/8"
        "60.0.0.0/8"
        "61.0.0.0/8"
        "101.0.0.0/8"
        "103.0.0.0/8"
        "106.0.0.0/8"
        "110.0.0.0/8"
        "111.0.0.0/8"
        "112.0.0.0/8"
        "113.0.0.0/8"
        "114.0.0.0/8"
        "115.0.0.0/8"
        "116.0.0.0/8"
        "117.0.0.0/8"
        "118.0.0.0/8"
        "119.0.0.0/8"
        "120.0.0.0/8"
        "121.0.0.0/8"
        "122.0.0.0/8"
        "123.0.0.0/8"
        "124.0.0.0/8"
        "125.0.0.0/8"
        "126.0.0.0/8"
        "133.0.0.0/8"
        "150.0.0.0/8"
        "153.0.0.0/8"
        "163.0.0.0/8"
        "171.0.0.0/8"
        "175.0.0.0/8"
        "177.0.0.0/8"
        "179.0.0.0/8"
        "180.0.0.0/8"
        "181.0.0.0/8"
        "182.0.0.0/8"
        "183.0.0.0/8"
        "186.0.0.0/8"
        "187.0.0.0/8"
        "189.0.0.0/8"
        "190.0.0.0/8"
        "200.0.0.0/8"
        "201.0.0.0/8"
        "202.0.0.0/8"
        "203.0.0.0/8"
        "210.0.0.0/8"
        "211.0.0.0/8"
        "218.0.0.0/8"
        "219.0.0.0/8"
        "220.0.0.0/8"
        "221.0.0.0/8"
        "222.0.0.0/8"
        "223.0.0.0/8"
        )

for blockapnic in "${APNIC[@]}"
do
        $iptables -A INPUT --source $blockapnic -j DROP
done

$iptables -N LOGGING
$iptables -A INPUT -j LOGGING
$iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
$iptables -A LOGGING -j DROP
$iptables -A LOGGING -j REJECT

# PING Sperre
$iptables -A INPUT -i eth0 -j REJECT

# SICHERHEIT
$iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j DROP
$iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
$iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s

logit "[OK] Firewall has been activated, the server is protected."
;;
stop)
logit "[+] Stopping firewall..."

$iptables -t nat -F
$iptables -t filter -F
$iptables -X
$iptables -P INPUT ACCEPT
$iptables -P OUTPUT ACCEPT
$iptables -P FORWARD ACCEPT
$iptablesv6 -t nat -F
$iptablesv6 -t filter -F
$iptablesv6 -X
$iptablesv6 -P INPUT ACCEPT
$iptablesv6 -P OUTPUT ACCEPT
$iptablesv6 -P FORWARD ACCEPT

logit "[!] Firewall has been stopped, the server is unprotected."
;;
restart|reload|force-reload)
$0 stop
$0 start
;;
*)
logit "[Error] Invalid argument."
logit "Usage: $0 (start|stop|restart)"
exit 1
#;;
esac
exit 0

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
logpath = /var/log/auth.log
maxretry = 3
bantime = 7d
findtime = 10m

[Unit]
Description=OScam daemon
After=tmp.mount network.target

[Service]
Type=forking
ExecStart=/usr/local/bin/oscam -b -B /var/run/oscam.pid -p 256 -w 5 -r 2 -c /usr/local/etc

[Install]
WantedBy=multi-user.target