135 lines
2.6 KiB
Markdown
135 lines
2.6 KiB
Markdown
|
# Quick Start : Sécuriser Forgejo contre les bots (15 min)
|
|||
|
|
|
|||
|
|
## Problème
|
|||
|
|
Bots qui téléchargent massivement des archives → Disque saturé (47G en 24-48h)
|
|||
|
|
|
|||
|
|
## Solution en 3 étapes
|
|||
|
|
|
|||
|
|
### 1️⃣ Fail2ban : Ban plus rapide (3 min)
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
sudo nano /etc/fail2ban/jail.d/forgejo.conf
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Changez ces valeurs :**
|
|||
|
|
```ini
|
|||
|
|
maxretry = 8 # Au lieu de 20
|
|||
|
|
bantime = 21600 # Au lieu de 3600
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Ajoutez (si absent) :**
|
|||
|
|
```ini
|
|||
|
|
bantime.increment = true
|
|||
|
|
bantime.factor = 2
|
|||
|
|
bantime.maxtime = 604800
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
sudo systemctl restart fail2ban
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### 2️⃣ Forgejo : Rate limit + Expiration (3 min)
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
nano /home/debian/forgejo/data/gitea/conf/app.ini
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Changez ces valeurs :**
|
|||
|
|
```ini
|
|||
|
|
[api]
|
|||
|
|
RATE_LIMIT_BURST = 20 # Au lieu de 100
|
|||
|
|
|
|||
|
|
[repository.local]
|
|||
|
|
ARCHIVE_EXPIRY = 3600 # Au lieu de 604800
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
docker restart forgejo
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
### 3️⃣ Cron : Nettoyage plus fréquent (2 min)
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
sudo crontab -e
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Remplacez la ligne existante par :**
|
|||
|
|
```bash
|
|||
|
|
0 */6 * * * find /home/debian/forgejo/data/gitea/repo-archive -type f -mmin +360 -delete
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Nettoyage initial
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# Voir la taille
|
|||
|
|
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
|||
|
|
|
|||
|
|
# Nettoyer maintenant
|
|||
|
|
find /home/debian/forgejo/data/gitea/repo-archive -type f -delete
|
|||
|
|
|
|||
|
|
# Vérifier
|
|||
|
|
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Vérification quotidienne
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
# Taille du cache (objectif : < 5G)
|
|||
|
|
du -sh /home/debian/forgejo/data/gitea/repo-archive
|
|||
|
|
|
|||
|
|
# IP bannies (doit augmenter)
|
|||
|
|
sudo fail2ban-client status forgejo-archive
|
|||
|
|
|
|||
|
|
# Top 5 IP actives
|
|||
|
|
docker logs forgejo --since 24h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn | head -5
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Résultat attendu
|
|||
|
|
|
|||
|
|
| Avant | Après |
|
|||
|
|
|-------|-------|
|
|||
|
|
| 47G de cache | 2-3G max |
|
|||
|
|
| 20 archives avant ban | 8 archives avant ban |
|
|||
|
|
| Ban 1h | Ban 6h (puis 12h, 24h...) |
|
|||
|
|
| 100 requêtes/min | 20 requêtes/min |
|
|||
|
|
| Archives gardées 7j | Archives supprimées après 1h |
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
## Dépannage
|
|||
|
|
|
|||
|
|
**Le cache se remplit encore ?**
|
|||
|
|
```bash
|
|||
|
|
# Voir qui télécharge
|
|||
|
|
docker logs forgejo --since 1h | grep "archive" | grep -oP '\d+\.\d+\.\d+\.\d+' | sort | uniq -c | sort -rn
|
|||
|
|
|
|||
|
|
# Bannir manuellement
|
|||
|
|
sudo fail2ban-client set forgejo-archive banip IP_SUSPECTE
|
|||
|
|
|
|||
|
|
# Vérifier Fail2ban
|
|||
|
|
sudo fail2ban-client status forgejo-archive
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
**Fail2ban ne bannit pas ?**
|
|||
|
|
```bash
|
|||
|
|
# Tester la regex
|
|||
|
|
sudo fail2ban-regex /var/lib/docker/containers/.../...json.log /etc/fail2ban/filter.d/forgejo-archive.conf
|
|||
|
|
|
|||
|
|
# Logs Fail2ban
|
|||
|
|
sudo tail -f /var/log/fail2ban.log
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
Pour plus de détails, voir le guide complet : [bloquer-telechargements-abusifs.md](bloquer-telechargements-abusifs.md)
|