setup-security.sh

#!/bin/bash
# SPDX-FileCopyrightText: 2025 Juan Manuel Méndez Rey
# SPDX-License-Identifier: GPL-3.0-or-later

set -e

echo "🛡️ Conquer Web Security Enhancement Setup"
echo "========================================"
echo ""

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    echo "❌ This script must be run as root"
    echo "   Run with: sudo $0"
    exit 1
fi

# Read domain from production config if available
PROJECT_DIR="/home/conquer/conquer-web"
if [ -f "$PROJECT_DIR/config/production.env" ]; then
    source "$PROJECT_DIR/config/production.env"
    DOMAIN_NAME="$DOMAIN"
else
    echo "⚠️  Production environment not found. Using generic configuration."
    DOMAIN_NAME="your-domain"
fi

echo "🔍 Configuring security for domain: $DOMAIN_NAME"
echo ""

# Install fail2ban
echo "📦 Installing fail2ban..."
apt update
apt install -y fail2ban

# Create fail2ban configuration
echo "🔧 Configuring fail2ban for Conquer Web..."
cat > /etc/fail2ban/jail.d/conquer-web.conf << EOF
# Conquer Web fail2ban configuration
# Auto-generated by setup-security.sh

[apache-auth-conquer]
enabled = true
port = http,https
filter = apache-auth
logpath = /var/log/apache2/conquer_*_error.log
maxretry = 3
bantime = 3600
findtime = 600
action = iptables-multiport[name=apache-auth-conquer, port="http,https", protocol=tcp]

[apache-dos-conquer]
enabled = true
port = http,https
filter = apache-dos-conquer
logpath = /var/log/apache2/conquer_*_access.log
maxretry = 200
bantime = 1800
findtime = 300
action = iptables-multiport[name=apache-dos-conquer, port="http,https", protocol=tcp]

[ttyd-auth]
enabled = true
port = http,https
filter = ttyd-auth
logpath = /var/log/apache2/conquer_*_error.log
maxretry = 5
bantime = 7200
findtime = 900
action = iptables-multiport[name=ttyd-auth, port="http,https", protocol=tcp]
EOF

# Create custom ttyd filter
echo "🎯 Creating custom ttyd authentication filter..."
cat > /etc/fail2ban/filter.d/ttyd-auth.conf << 'EOF'
# fail2ban filter for ttyd authentication failures
# Matches Apache error log entries for HTTP 401 responses

[Definition]
failregex = ^.* \[client <HOST>:\d+\] client sent HTTP code 401.*
            ^.* \[client <HOST>:\d+\] AH01797: client denied by server configuration.*
            ^.* \[client <HOST>:\d+\] AH01630: client denied by server configuration.*

ignoreregex =
EOF

# Create custom DoS filter for Apache access logs
echo "🎯 Creating custom DoS protection filter..."
cat > /etc/fail2ban/filter.d/apache-dos-conquer.conf << 'EOF'
# fail2ban filter for DoS attacks via Apache access logs
# Detects excessive requests from single IP

[Definition]
failregex = ^<HOST> -.*"(GET|POST).*" (200|206|301|302) .*$

ignoreregex =
EOF

# Enable and start fail2ban
echo "🚀 Starting fail2ban service..."
systemctl enable fail2ban
systemctl restart fail2ban

# Install logwatch for log monitoring
echo "📊 Installing logwatch for log monitoring..."
apt install -y logwatch

# Create additional Apache security configuration
echo "🔒 Adding enhanced Apache security headers..."
cat > /etc/apache2/conf-available/conquer-security.conf << 'EOF'
# Enhanced security configuration for Conquer Web
# Auto-generated by setup-security.sh

# Additional security headers
Header always set X-Robots-Tag "noindex, nofollow"
Header always set X-Permitted-Cross-Domain-Policies "none"
Header always set Cross-Origin-Embedder-Policy "require-corp"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Resource-Policy "same-origin"

# Hide server information
Header always unset X-Powered-By
Header always unset Server
ServerTokens Prod

# Block suspicious request patterns
<LocationMatch "(\.php|\.asp|\.jsp|wp-admin|phpmyadmin|\.git|\.env|config)">
    Require all denied
</LocationMatch>

# Request filtering
RewriteEngine On
RewriteCond %{QUERY_STRING} (union.*select|concat.*\(|script.*>) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.\/|\.\.\\|etc\/passwd|boot\.ini) [NC,OR]
RewriteCond %{QUERY_STRING} (<script|javascript:|vbscript:|onload|onerror) [NC]
RewriteRule .* - [F,L]

# Limit request methods (applied globally)
<Location />
    <RequireAll>
        Require method GET POST HEAD OPTIONS
    </RequireAll>
</Location>
EOF

# Enable the new security configuration
a2enconf conquer-security

# Test configurations
echo "🧪 Testing configurations..."

# Test fail2ban configuration
echo "Testing fail2ban configuration..."
if fail2ban-client -t; then
    echo "✅ fail2ban configuration is valid"
else
    echo "❌ fail2ban configuration has errors"
    echo "Checking fail2ban logs for details:"
    journalctl -u fail2ban --no-pager -n 20
    echo ""
    echo "You can check the configuration manually with:"
    echo "sudo fail2ban-client -t"
    echo "sudo fail2ban-client -d"
    exit 1
fi

# Test Apache configuration
if apache2ctl configtest; then
    echo "✅ Apache configuration is valid"
    systemctl reload apache2
else
    echo "❌ Apache configuration has errors"
    exit 1
fi

# Create monitoring script
echo "📝 Creating security monitoring script..."
cat > "$PROJECT_DIR/check-security.sh" << 'EOF'
#!/bin/bash
# SPDX-FileCopyrightText: 2025 Juan Manuel Méndez Rey
# SPDX-License-Identifier: GPL-3.0-or-later

echo "🛡️ Conquer Web Security Status Check"
echo "===================================="
echo ""

# Check fail2ban status
echo "📊 fail2ban Status:"
fail2ban-client status

echo ""
echo "🚫 Currently Banned IPs:"
for jail in $(fail2ban-client status | grep "Jail list:" | cut -d: -f2 | tr ',' '\n' | xargs); do
    echo "Jail: $jail"
    fail2ban-client status "$jail" | grep "Banned IP list"
done

echo ""
echo "📈 Recent Authentication Failures (last 10):"
grep "401" /var/log/apache2/conquer_*_access.log 2>/dev/null | tail -10 || echo "No recent failures found"

echo ""
echo "🔍 Suspicious Activity Check:"
grep -i "attack\|hack\|exploit\|scan" /var/log/apache2/conquer_*_error.log 2>/dev/null | tail -5 || echo "No suspicious activity detected"

echo ""
echo "💾 System Resources:"
df -h / | tail -1
free -h | grep Mem
EOF

chmod +x "$PROJECT_DIR/check-security.sh"
chown conquer:conquer "$PROJECT_DIR/check-security.sh"

echo ""
echo "🎉 Security enhancements installed successfully!"
echo ""
echo "📋 What was configured:"
echo "   ✅ fail2ban with custom Conquer Web rules"
echo "   ✅ Enhanced Apache security headers"
echo "   ✅ Request filtering and attack protection"
echo "   ✅ Log monitoring with logwatch"
echo "   ✅ Security monitoring script created"
echo ""
echo "🔧 Management Commands:"
echo "   sudo fail2ban-client status                    # Check fail2ban status"
echo "   sudo fail2ban-client status apache-auth-conquer # Check banned IPs"
echo "   cd $PROJECT_DIR && ./check-security.sh         # Run security check"
echo "   sudo tail -f /var/log/fail2ban.log            # Monitor bans in real-time"
echo ""
echo "📚 Documentation:"
echo "   See SECURITY.md for detailed configuration and maintenance guide"
echo ""
echo "🔒 Your Conquer Web installation now has enhanced protection against:"
echo "   - Brute force authentication attacks"
echo "   - DoS and DDoS attempts"
echo "   - Common web application attacks"
echo "   - Automated scanning and bot activity"
echo ""
echo "🛡️ Security enhancement complete!"