Add fail2ban - default disable

Author: RootShell-coder

docker/Dockerfile

@@ -13,7 +13,10 @@ RUN set -eux; \
     bind-tools \
     bind-dnssec-tools \
     openssl \
-    tzdata; \
+    tzdata \
+    fail2ban \
+    iptables \
+    ip6tables; \
   tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz; \
   tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz; \
   rm -rf /tmp/* /var/cache/apk/* /etc/bind/*; \
@@ -22,6 +25,8 @@ RUN set -eux; \
 COPY ./bind /etc/bind
 COPY ./services.d /etc/services.d
 COPY ./cont-init.d /etc/cont-init.d
+COPY ./fail2ban/jail.local /etc/fail2ban/jail.local
+COPY ./fail2ban/filter.d /etc/fail2ban/filter.d
 
 RUN chmod +x /etc/services.d/*/run /etc/cont-init.d/*
 

docker/bind/logging.conf

@@ -1,12 +1,19 @@
 logging {
     channel default_log { syslog daemon; severity info; print-severity yes; print-category yes; print-time yes; };
     channel errors_log { syslog daemon; severity warning; print-severity yes; print-category yes; print-time yes; };
+    channel security_file {
+        file "/var/log/named/security.log" versions 3 size 10m;
+        severity dynamic;
+        print-severity yes;
+        print-category yes;
+        print-time yes;
+    };
 
     category default { default_log; };
     category config { default_log; };
-    category security { errors_log; };
-    category xfer-in { default_log; };
-    category xfer-out { default_log; };
+    category security { errors_log; security_file; };
+    category xfer-in { default_log; security_file; };
+    category xfer-out { default_log; security_file; };
     category update { default_log; };
     category dnssec { default_log; };
     category queries { default_log; };

docker/cont-init.d/02-fail2ban.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+log() {
+    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1"
+}
+
+[ "${FAIL2BAN_ENABLED:-false}" = "true" ] || { log "fail2ban disabled, skipping setup"; exit 0; }
+
+log "Create fail2ban runtime directories"
+mkdir -p /run/fail2ban /var/lib/fail2ban /var/log/fail2ban
+
+log "Create named log directory"
+mkdir -p /var/log/named
+chown named:named /var/log/named
+
+log "Pre-create security log so fail2ban can monitor it from startup"
+touch /var/log/named/security.log
+chown named:named /var/log/named/security.log

docker/fail2ban/filter.d/named-security.conf

@@ -0,0 +1,19 @@
+# Fail2ban filter for BIND9 / named security events
+#
+# Catches:
+#  - Refused recursive queries (query cache denied)
+#  - Refused zone transfers
+#  - Bad/unauthorized RNDC requests
+
+[Definition]
+
+_daemon = named
+
+failregex = ^%(__prefix_line)s\s*client(?:\s+@\w+)?\s+<HOST>#\d+\s+(?:\(\S+\)\s+)?:\s*(?:view\s+\S+:\s+)?query \(cache\) '.*' denied\s*$
+            ^%(__prefix_line)s\s*client(?:\s+@\w+)?\s+<HOST>#\d+\s*:\s*(?:view\s+\S+:\s+)?(?:transfer of '.*': REFUSED|zone transfer '.*' denied)\s*$
+            ^%(__prefix_line)s\s*client(?:\s+@\w+)?\s+<HOST>#\d+\s*:\s*request has invalid signature\s*$
+
+ignoreregex =
+
+# Log format example:
+# 30-May-2026 10:15:23.456 security: client @0x7f1234567890 192.168.1.100#54321 (example.com): query (cache) 'example.com/ANY/IN' denied

docker/fail2ban/jail.local

@@ -0,0 +1,16 @@
+[DEFAULT]
+# Ban duration: 1 hour
+bantime  = 3600
+# Scan last 10 minutes for offenses
+findtime = 600
+# Default max retries before ban
+maxretry = 5
+
+[named-security]
+enabled  = true
+filter   = named-security
+logpath  = /var/log/named/security.log
+# Ban after 3 violations (refused queries / zone transfer attempts)
+maxretry = 3
+bantime  = 3600
+banaction = iptables-allports

docker/services.d/fail2ban/run

@@ -0,0 +1,3 @@
+#!/bin/sh
+[ "${FAIL2BAN_ENABLED:-false}" = "true" ] || { echo "fail2ban disabled"; exec tail -f /dev/null; }
+exec fail2ban-server -f -x -s /run/fail2ban/fail2ban.sock 2>&1

example/docker-compose.yml

@@ -7,6 +7,10 @@ services:
       - "53:53/tcp"
     # - "953:953/tcp"
     restart: always
+    environment:
+      - FAIL2BAN_ENABLED=false
+    cap_add:
+      - NET_ADMIN
     volumes:
       - bind_keys:/var/cache/bind/keys
       - ./bind:/etc/bind