SWAG Integration

[Jandalslap]

Hey, great app. I really want to use it however my fail2ban instance is integrated in the SWAG docker container and does not have the same structure as the native install. Seems to be missing the separated jail archives for the logs. SWAG just compiles them all into one fail2ban.log. Do you see any way I might be able to circumvent this with a few easy changes to at least be able to import the one log and monitor it. Thanks.

[SubleXBle]

Hi, can you provide a logfile example?

I can have a look into it.

[Jandalslap]

Hey, thanks for the reply. A log file wouldnt help you any I'm afraid. To understand what I mean you would be best to spin up a docker container of SWAG and have a look at the folder structure of Fail2ban inside.

https://docs.linuxserver.io/images/docker-swag/#usage

As you can see there is no fail2ban archive directory in the folder structure with separate jail directories that your app retrieves individual logs from I think. Instead there is just a conf file jail.local that creates jails.

So in your compose example this volume has nothing to map to:
volumes:
- /var/www/html/Fail2Ban-Report/archive:/var/www/html/Fail2Ban-Report/archive:rw

docker exec -it swag tree /config/fail2ban
/config/fail2ban
├── action.d
│ ├── abuseipdb.conf ...
├── badbots
│ ├── cloudflare_badbots.list ...
├── fail2ban.conf
├── fail2ban.sqlite3
├── filter.d
│ ├── 3proxy.conf ...
└── jail.local

4 directories, 187 files

Then all jail logs are written to a combined fail2ban.log file which I dont think your app is able to parse.

docker exec -it swag tree /config/log/fail2ban
/config/log/fail2ban
├── fail2ban.log
├── fail2ban.log.1
├── fail2ban.log.2.gz
├── fail2ban.log.3.gz
├── fail2ban.log.4.gz
├── fail2ban.log.5.gz
├── fail2ban.log.6.gz
└── fail2ban.log.7.gz

0 directories, 8 files

I cloned this repo:
https://github.com/SubleXBle/Fail2Ban-Report

This is the Dockerfile I used

Use PHP with Apache

FROM php:8.2-apache

Set working directory

WORKDIR /var/www/html

Copy the entire Web-UI folder into Apache root

COPY Web-UI/ /var/www/html/

Create required directories for configs and archive

RUN mkdir -p /opt/Fail2Ban-Report/Settings
/var/www/html/archive/fail2ban &&
chown -R www-data:www-data /var/www/html /opt/Fail2Ban-Report

Copy actual fail2ban-report config

COPY Conf/fail2ban-report.config /opt/Fail2Ban-Report/Settings/fail2ban-report.config

Create an empty users.json if it doesn't exist

RUN touch /opt/Fail2Ban-Report/Settings/users.json

Install dependencies

RUN apt-get update &&
apt-get install -y --no-install-recommends jq curl gawk ufw &&
rm -rf /var/lib/apt/lists/*

Enable Apache mod_rewrite

RUN a2enmod rewrite

Configure Apache to listen on port 5000

RUN sed -i 's/80/5000/' /etc/apache2/ports.conf /etc/apache2/sites-available/000-default.conf

Expose port 5000 for SWAG reverse proxy

EXPOSE 5000

Start Apache in foreground

CMD ["apache2-foreground"]

and created my own compose to map the combined log just to see what it would do but it wouldnt parse anything from it. It was definitely imported into the container:

docker exec -it fail2ban-report sh

cd archive/fail2ban/fail2ban

ls -la

total 132
drwxr-xr-x 2 root root 4096 Aug 31 09:15 .
drwxr-xr-x 1 www-data www-data 4096 Aug 31 09:15 ..
-rwxr-xr-x 1 1026 users 121954 Aug 31 09:20 fail2ban.log

services:
fail2ban-report:
image: custom/fail2ban-report:latest
container_name: fail2ban-report
volumes:
- ${CONFIG_PATH}/swag/config/log/fail2ban/fail2ban.log:/var/www/html/archive/fail2ban/fail2ban/fail2ban.log:ro
- ${CONFIG_PATH}/fail2ban-report/config:/opt/Fail2Ban-Report/Settings
#ports:
#- 5000:5000
restart: unless-stopped
networks:
- docker_network

networks:
docker_network:
external: true

The webui loaded up at my specified url and the login worked against the users.json I created in Settings (config volume map). But empty of log entries of course..

Anyway, it was a long shot to see if there was perhaps something else I could try. I realise this is not your apps intended use case but if it was something you were interested in looking at I thought I'd let you know about it. I reckon a lot of people use SWAG with fail2ban. Just to note, often with SWAG they (linuxserver.io ?) will create a docker mod for the container that imports extra features like this such as their dashboard.

Thanks mate

[Jandalslap]

Side note: looking at this again I realised that my mapping may be off where I have archive/fail2ban/fail2ban/fail2ban.log
If you think that the combined fail2ban.log can be read by the app maybe it’s just that it needs to be one directory higher. I believe the app is creating those directories though that’s why I mapped it there. Anyway maybe that’s the issue.

[SubleXBle]

As It seems to use Fail2Ban (just I side of a container) it should be possible to read the Logfile with the .sh
We just need a way to read it from the container, so should be possible so far.

[Jandalslap]

Ok I’ll play around with again tomorrow and see if I can get the log into the actual archive directory. I’m just not sure about how it could determine info about the individual jails.

[SubleXBle]

it will depend on some things, the scrip will to have to get inside the container first, then it can start to parse the logfile - but it will have to save it's json file outside the containter to hand it over to Fail2Ban-Report.
I am not at home right now so I can start testing stuff with docker envoirement when I am back at home. (just sitting on an cheap notebook for this week, just able to do some basic stuff)

[Jandalslap]

Yah I got that happening :-) I changed the fail2ban_log2json.sh path to find the log inside the container. The volume is already mapped in my compose so the json is stored outside the container. I ran the script manually and it populated the webui!

So the Dockerfile and compose I used are attached. I have just been playing around though so the Dockerfile is a bit hacky...

Things to note:

Needs higher level access for the ufw bans.
I have no Blocklist yet so the webui bans dont work (I was able to run the script manually from in the container though with elevated privileges). How are Blocklists created?
I was trying to add cron into the container as well to automate the scripts

But yeah I would definately say its possible to get this working!

I'll leave it with you for a while now for when you get back home as you know what you are doing :-) We should fork the project and create a new repo for this SWAG version aye?

Dockerfile.txt
fail2ban-report-compose.txt

These were the paths I used in the fail2ban_log2json.sh

Path to the log inside the container

LOGFILE="/var/www/html/archive/swag/fail2ban/fail2ban.log"

Output folder for JSON

OUTPUT_JSON_DIR="/var/www/html/archive/swag/fail2ban"

[SubleXBle]

nice Work, thank you for sharing!
Blocklists work by creating a json file in your archive//blocklists/ with the name of the originating blocklist (ssh / apache-auth) as name (e.G.: ssh.blocklist.json)
the firewall-update.sh script can comunicate with UFW - so it looks at the blocklist (like in fail2ban_log2json.sh you have a path to the json files on the script) and set/unset bans in UFW Firewall.
When your Firewall is handled by antother programm / or container, you can set UFW as "default allow" and set perma bans with blocklist from WebUI.
in the Docker-Container, i did this by having local access to /arcchive/ and opt/Fail2Ban-Report/ so they can communicate with each other. But Docker-Version is still on V0.4.0 so more the "Single-Server-Version".

Like I said, I am hopefully back at home by next week (at hospital rn - having an operation tomorrow) .. then I can do stuff again ... 🙏

I will have a look at it then and will come back at you when upgrading the docker-version to ether merge it there or if you want we can make its own version for swag - lets "chat" then - looking forward to it 👍

[Jandalslap]

Definitely. Good luck with the op, I appreciate you replying while in hospital! But I guess there’s not much else to do while you’re lying around waiting right? :)