openship 0.4.4 → 0.4.6

package/dist/server/engine/samples/dovecot/sql/used_quota.mysql

@@ -0,0 +1,26 @@
+-- used_quota
+-- Used to store realtime mailbox quota in Dovecot.
+-- WARNING: Works only with Dovecot 1.2+.
+--
+-- Note: Don't touch this table, it will be updated by Dovecot automatically.
+CREATE TABLE IF NOT EXISTS `used_quota` (
+    `username` VARCHAR(255) NOT NULL,
+    `bytes` BIGINT NOT NULL DEFAULT 0,
+    `messages` BIGINT NOT NULL DEFAULT 0,
+    `domain` VARCHAR(255) NOT NULL DEFAULT '',
+    PRIMARY KEY (`username`),
+    INDEX (domain)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- Trigger `used_quota_before_insert` is used to set `used_quota.domain`.
+-- NOTE: `used_quota.domain` is not used by Dovecot, but used in iRedAdmin to
+--       get better SQL query performance while calculating per-domain used
+--       quota.
+DELIMITER //
+CREATE TRIGGER `used_quota_before_insert`
+    BEFORE INSERT ON `used_quota` FOR EACH ROW
+    BEGIN
+        SET NEW.domain = SUBSTRING_INDEX(NEW.username, '@', -1);
+    END;
+//
+DELIMITER ;

package/dist/server/engine/samples/dovecot/systemd/override.conf

@@ -0,0 +1,3 @@
+[Service]
+ProtectSystem=false
+#ProtectHome=false

package/dist/server/engine/samples/fail2ban/action.d/banned_db.conf

@@ -0,0 +1,9 @@
+# - Store banned IP in SQL db while it's banned.
+# - Remove banned IP from SQL db while it's unbanned.
+
+[Definition]
+actionstart = /usr/local/bin/fail2ban_banned_db start <name>
+actioncheck =
+actionban   = /usr/local/bin/fail2ban_banned_db ban <ip> <port> <protocol> <name> <ipjailfailures> <ipjailmatches>
+actionunban = /usr/local/bin/fail2ban_banned_db unban <ip>
+actionstop  = /usr/local/bin/fail2ban_banned_db stop <name>

package/dist/server/engine/samples/fail2ban/bin/fail2ban_banned_db

@@ -0,0 +1,268 @@
+#!/usr/bin/env bash
+# Author: Zhang Huangbin <zhb@iredmail.org>
+# Puprpose:
+#   - Store banned IP address in SQL db while it's banned by Fail2ban.
+#   - Remove unbanned IP address from SQL db while it's unbanned by Fail2ban.
+#   - Unban IP addresses which have column `remove=1`.
+
+# Usage:
+#
+#   *) Store a banned IP address:
+#
+#       banned_db ban <ip> <ports> <protocol> <jail> <failures> [loglines]
+#
+#       - <ip>: One IP address each time.
+#       - <ports>: Network ports. Multiple ports must be separated by comma.
+#       - <protocol>: `tcp` or `udp`.
+#       - <jail>: Fail2ban jail name.
+#       - <failures>: number of times the failure occurred in the log file.
+#       - [loglines]: matched log lines. OPTIONAL.
+#
+#   *) Remove an one or multiple unbanned IP addresses. Notes:
+#
+#       - it removes IP from all jails.
+#       - multiple IP addresses must be separated by space.
+#
+#       banned_db unban <ip> [ip] [ip]
+#
+#   *) Cleanup a jail. When Fail2ban is stopping or restarting, `cleanup` will
+#      be executed. Cleanup manually is supported too:
+#
+#       banned_db cleanup <jail>
+#
+#   *) Query SQL db and remove IP addresses which have `remove=1`.
+#
+#       banned_db unban_db
+#
+# Examples:
+#
+#   banned_db start dovecot-iredmail
+#   banned_db ban   192.168.0.1 110,143,993,995 tcp dovecot-iredmail 3
+#   banned_db unban 192.168.0.1
+#   banned_db stop dovecot-iredmail
+#   banned_db unban_db
+
+#
+# Sample Fail2ban jail config file (/etc/fail2ban/jail.d/xx.local):
+#
+#   [jail-name]
+#   ...
+#   action = ...[your other actions here]...
+#            banned_db[name=jail-name, port="80", protocol=tcp]
+#
+# WARNING: the name set in `banned_db[name=]` must be same as the jail name.
+
+export PATH="/usr/bin:/usr/local/bin:$PATH"
+
+export DB_NAME="fail2ban"
+export DB_TABLE_BANNED="banned"
+export DB_TABLE_JAILS="jails"
+export DB_USER="fail2ban"
+
+# GeoIP
+export CMD_GEOIPLOOKUP="$(which geoiplookup 2>/dev/null)"
+export CMD_GEOIPLOOKUP6="$(which geoiplookup6 2>/dev/null)"
+
+# `dig`. Used to query reverse hostname.
+export CMD_DIG="/usr/bin/dig"
+
+if [ -f /root/.my.cnf-fail2ban ]; then
+    export CMD_SQL="mysql --defaults-file=/root/.my.cnf-fail2ban ${DB_NAME}"
+    export DB_TYPE="mysql"
+elif [ -f /root/.my.cnf ]; then
+    export CMD_SQL="mysql --defaults-file=/root/.my.cnf ${DB_NAME}"
+    export DB_TYPE="mysql"
+else
+    # Absolute path to ~/.pgpass
+    #   - RHEL:             /var/lib/pgsql/.pgpass
+    #   - Debian/Ubuntu:    /var/lib/postgresql/.pgpass
+    #   - FreeBSD:          /var/db/postgres/.pgpass
+    #   - OpenBSD:          /var/postgresql/.pgpass
+    for dir in \
+        /var/lib/pgsql \
+        /var/lib/postgresql \
+        /var/db/postgres \
+        /var/postgresql; do
+        if [ -f ${dir}/.pgpass ]; then
+            export PGPASSFILE="${dir}/.pgpass"
+            export CMD_SQL="psql -U ${DB_USER} -d ${DB_NAME}"
+            export DB_TYPE="pgsql"
+            break
+        fi
+    done
+fi
+
+if [ X"${CMD_SQL}" == X'' ]; then
+    echo "No MySQL or PostgreSQL related config file found. Abort."
+    echo " - MySQL: /root/.my.cnf-fail2ban (or /root/.my.cnf)"
+    echo " - PostgreSQL: ~/.pgpass (under PostgreSQL daemon user's home directory)"
+    exit 255
+fi
+
+export _action="$1"
+
+if [[ X"${_action}" == X'start' ]]; then
+    _jail="${2}"
+
+    if [[ X"${DB_TYPE}" == X'pgsql' ]]; then
+        # CentOS 7 ships PostgreSQL-9.2 which doesn't support `ON CONFLICT DO NOTHING`,
+        # so we query it first, insert it if not existing.
+        (${CMD_SQL} <<EOF
+SELECT id FROM ${DB_TABLE_JAILS} WHERE name='${_jail}' LIMIT 1;
+EOF
+) | grep '1 row' &>/dev/null
+
+        if [[ X"$?" != X'0' ]]; then
+            ${CMD_SQL} >/dev/null <<EOF
+INSERT INTO ${DB_TABLE_JAILS} (name, enabled) VALUES ('${_jail}', 1);
+EOF
+        fi
+    else
+        ${CMD_SQL} >/dev/null <<EOF
+INSERT IGNORE INTO ${DB_TABLE_JAILS} (name, enabled) VALUES ('${_jail}', 1);
+EOF
+    fi
+elif [[ X"${_action}" == X"ban" ]]; then
+    _ip="${2}"
+    _ports="${3}"
+    _protocol="${4}"
+    _jail="${5}"
+    _failures="${6}"
+
+    shift 6
+
+    # (base64) Encode log lines to avoid possible SQL injection.
+    if [[ -x /usr/bin/base64 ]]; then
+        # Linux
+        _loglines="$(echo $@ | base64)"
+    elif [[ -x /usr/bin/b64encode ]]; then
+        # OpenBSD and FreeBSD.
+        _loglines="$(echo $@ | b64encode - |grep -Ev '^(begin-base64 |====$)')"
+    else
+        _loglines=""
+    fi
+
+    if [[ X"${_ip}" == X'' ]] || \
+        [[ X"${_ports}" == X'' ]] || \
+        [[ X"${_protocol}" == X'' ]] || \
+        [[ X"${_jail}" == X'' ]]; then
+        echo "IP, ports, protocol, or jail name is empty. Abort."
+        exit 255
+    fi
+
+    _hostname="$(hostname)"
+
+    # Lookup for country name.
+    _country=''
+    if echo ${_ip} | grep ':' &>/dev/null; then
+        if [[ -x ${CMD_GEOIPLOOKUP6} ]]; then
+            _country="$(${CMD_GEOIPLOOKUP6} ${_ip} | grep '^GeoIP Country Edition:' | awk -F': ' '{print $2}' | grep -iv 'not found' | tr -d '"' | tr -d "'")"
+        fi
+    else
+        if [[ -x ${CMD_GEOIPLOOKUP} ]]; then
+            _country="$(${CMD_GEOIPLOOKUP} ${_ip} | grep '^GeoIP Country Edition:' | awk -F': ' '{print $2}' | grep -iv 'not found' | tr -d '"' | tr -d "'")"
+        fi
+    fi
+
+    # Lookup reverse DNS name.
+    _rdns=''
+    if [[ -x "${CMD_DIG}" ]]; then
+        _rdns_orig="$(${CMD_DIG} +short +timeout=3 -x ${_ip} 2>/dev/null)"
+        _rdns_strip="${_rdns_orig%\.}"
+        printf -v _rdns "${_rdns_strip}"
+    fi
+
+    if [ X"${DB_TYPE}" == X'mysql' ]; then
+        # MySQL stores local time with time zone info, we expect UTC time.
+        ${CMD_SQL} >/dev/null <<EOF
+INSERT IGNORE INTO ${DB_TABLE_BANNED} (
+        ip, ports, protocol, jail,
+        hostname, country, rdns, timestamp,
+        failures, loglines)
+    VALUES (
+        '${_ip}', '${_ports}', '${_protocol}', '${_jail}',
+        '${_hostname}', '${_country}', '${_rdns}', UTC_TIMESTAMP(),
+        '${_failures}', '${_loglines}');
+EOF
+    else
+        # CentOS 7 ships PostgreSQL-9.2 which doesn't support `ON CONFLICT DO NOTHING`,
+        # so we query it first, insert it if not existing.
+        (${CMD_SQL} <<EOF
+SELECT id FROM ${DB_TABLE_BANNED} WHERE ip='${_ip}' AND ports='${_ports}' AND protocol='${_protocol}' AND jail='${_jail}' LIMIT 1;
+EOF
+) | grep '1 row' &>/dev/null
+
+        if [[ X"$?" == X'0' ]]; then
+            echo "Already banned."
+        else
+            ${CMD_SQL} >/dev/null <<EOF
+INSERT INTO ${DB_TABLE_BANNED} (
+        ip, ports, protocol, jail,
+        hostname, country, rdns,
+        failures, loglines)
+    VALUES (
+        '${_ip}', '${_ports}', '${_protocol}', '${_jail}',
+        '${_hostname}', '${_country}', '${_rdns}',
+        '${_failures}', '${_loglines}');
+EOF
+            echo "Stored."
+        fi
+    fi
+
+elif [[ X"${_action}" == X"unban" ]]; then
+    shift 1
+    _ips="$@"
+
+    if [[ X"${_ips}" == X'' ]]; then
+        echo "No IP address(es) specified."
+    else
+        for _ip in ${_ips}; do
+            ${CMD_SQL} >/dev/null <<EOF
+DELETE FROM ${DB_TABLE_BANNED} WHERE ip='${_ip}';
+EOF
+        done
+
+        [[ X"$?" == X'0' ]] && echo "Removed."
+    fi
+
+elif [[ X"${_action}" == X'stop' ]] || [[ X"${_action}" == X"cleanup" ]]; then
+    _jail="$2"
+
+    if [[ X"${_jail}" != X'' ]]; then
+        ${CMD_SQL} >/dev/null <<EOF
+DELETE FROM ${DB_TABLE_BANNED} WHERE jail='${_jail}';
+DELETE FROM ${DB_TABLE_JAILS} WHERE name='${_jail}';
+EOF
+    fi
+
+    [[ X"$?" == X'0' ]] && echo "All IP addresses have been removed."
+elif [[ X"${_action}" == X"unban_db" ]]; then
+    # Call fail2ban-client to unban given IP address(es).
+    tmp_file="$(mktemp)"
+
+    # Exclude extra info on output, just leave jail/ip.
+    (${CMD_SQL} <<EOF
+SELECT jail, ip FROM ${DB_TABLE_BANNED} WHERE remove=1;
+EOF
+) | grep -Ev '(jail.*ip|--|\(|^$)' | tr -d '|' >> ${tmp_file}
+
+    while read jail ip; do
+        # Avoid SQL injection: don't allow whitespace, ';', quotes in
+        # jail name and IP address.
+        if echo ${jail} | grep "[ ;\"\']" &>/dev/null; then
+            echo "[WARNING] Invalid jail name: '${jail}'."
+            continue
+        fi
+
+        if echo ${ip} | grep "[ ;\"\']" &>/dev/null; then
+            echo "[WARNING] Invalid IP address: '${ip}'."
+            continue
+        fi
+
+        # fail2ban-client returns number of processed rows on command line,
+        # let's discard it to avoid noise/confusion.
+        fail2ban-client set ${jail} unbanip ${ip} >/dev/null
+        [[ X"$?" == X'0' ]] && echo "Unbanned ${ip} from jail [${jail}]."
+    done < ${tmp_file}
+    rm -f ${tmp_file} &>/dev/null
+fi

package/dist/server/engine/samples/fail2ban/fail2ban.local

@@ -0,0 +1,17 @@
+[Definition]
+
+# Option: loglevel. Default is ERROR
+# Available options: CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG
+loglevel = INFO
+
+# Set the log target
+logtarget = SYSLOG
+
+# Syslog socket. Required on FreeBSD and OpenBSD.
+#syslogsocket = PH_SYSLOG_SOCKET
+
+# Fail2ban socket. Required on FreeBSD.
+#socket = /var/run/fail2ban/fail2ban.sock
+
+# Allows IPv6 interface.
+allowipv6 = auto

package/dist/server/engine/samples/fail2ban/filter.d/dovecot.iredmail.conf

@@ -0,0 +1,5 @@
+[Definition]
+failregex = Authentication failure.* rip=<HOST>
+            \(auth failed.* rip=<HOST>
+
+ignoreregex =

package/dist/server/engine/samples/fail2ban/filter.d/postfix-pregreet.iredmail.conf

@@ -0,0 +1,16 @@
+[Definition]
+
+# Block clients which cannot pass Postfix postscreen pregreet test.
+# FYI: http://www.postfix.org/POSTSCREEN_README.html#pregreet
+#
+# The SMTP protocol is a classic example of a protocol where the server speaks
+# before the client. postscreen(8) detects zombies that are in a hurry and that
+# speak before their turn.
+failregex = postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+:
+
+# while setting up new account, Thunderbird doesn't wait for server connection
+# greeting/banner, this causes Thunderbird cannot pass the Postfix pregreet
+# test and caught by `failregex` rules listed above (the rule contains
+# 'PREGREET' line).
+# FYI: https://bugzilla.mozilla.org/show_bug.cgi?id=538809#c41
+ignoreregex = postscreen\[\d+\]: PREGREET .* from \[<HOST>\]:\d+: (EHLO|HELO) we-guess.mozilla.org

package/dist/server/engine/samples/fail2ban/filter.d/postfix.iredmail.conf

@@ -0,0 +1,18 @@
+[Definition]
+# *) '554 5.7.1' is 'Helo command rejected: ACCESS DENIED'
+#
+#   'ACCESS DENIED' is string defined in postfix restriction rule `check_helo_access`.
+#   no all rules contains 'ACCESS DENIED', so we use status code insead.
+
+failregex = \[<HOST>\]: SASL (PLAIN|LOGIN) authentication failed
+            lost connection after AUTH from (.*)\[<HOST>\]
+            reject: RCPT from .*\[<HOST>\]: .*: Relay access denied
+            reject: RCPT from .*\[<HOST>\]: .*: Sender address rejected: Domain not found
+            reject: RCPT from .*\[<HOST>\]: .*: Helo command rejected: Host not found
+            reject: RCPT from .*\[<HOST>\]: .*: Helo command rejected: need fully-qualified hostname
+            reject: RCPT from .*\[<HOST>\]: 554 5.7.1
+            reject: RCPT from .*\[<HOST>\]:\d+: 550 5.5.1 Protocol error
+            warning: Illegal address syntax from (.*)\[<HOST>\] in RCPT command
+            postfix\/submission\/smtpd.*: too many errors after AUTH from .*\[<HOST>\]
+
+ignoreregex =

package/dist/server/engine/samples/fail2ban/filter.d/roundcube.iredmail.conf

@@ -0,0 +1,9 @@
+# 'X-Forwarded-For:` appears when Roundcube is running behind HAProxy.
+
+[Definition]
+failregex = roundcube.* Failed login .*\(X-Forwarded-For: <HOST>\) in session
+            roundcube.* Failed login for (.*) from <HOST>\. AUTHENTICATE LOGIN
+            roundcube.* Failed login for (.*) from <HOST> in session
+            roundcube.* Error: Login failed for (.*) from <HOST>\. (LOGIN: Authentication failed|AUTHENTICATE LOGIN)
+
+ignoreregex =

package/dist/server/engine/samples/fail2ban/jail.d/dovecot.local

@@ -0,0 +1,8 @@
+[dovecot]
+backend     = polling
+journalmatch=
+enabled     = true
+filter      = dovecot.iredmail
+logpath     = PH_DOVECOT_LOG_FILE tail
+action      = PH_FAIL2BAN_ACTION[name=dovecot, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=dovecot, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/nginx-http-auth.local

@@ -0,0 +1,8 @@
+[nginx-http-auth]
+backend     = polling
+journalmatch=
+enabled     = false
+filter      = nginx-http-auth
+logpath     = PH_NGINX_LOG_ERRORLOG tail
+action      = PH_FAIL2BAN_ACTION[name=nginx, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=nginx, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/postfix-pregreet.local

@@ -0,0 +1,9 @@
+[pregreet]
+backend     = polling
+journalmatch=
+enabled     = true
+maxretry    = 1
+filter      = postfix-pregreet.iredmail
+logpath     = PH_MAILLOG tail
+action      = PH_FAIL2BAN_ACTION[name=pregreet, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=pregreet, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/postfix.local

@@ -0,0 +1,8 @@
+[postfix]
+backend     = polling
+journalmatch=
+enabled     = true
+filter      = postfix.iredmail
+logpath     = PH_MAILLOG tail
+action      = PH_FAIL2BAN_ACTION[name=postfix, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=postfix, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/roundcube.local

@@ -0,0 +1,9 @@
+[roundcube]
+backend     = polling
+journalmatch=
+enabled     = false
+findtime    = 3600
+filter      = roundcube.iredmail
+logpath     = PH_RCM_LOGFILE tail
+action      = PH_FAIL2BAN_ACTION[name=roundcube, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=roundcube, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/sogo.local

@@ -0,0 +1,8 @@
+[sogo]
+backend     = polling
+journalmatch=
+enabled     = false
+filter      = sogo-auth
+logpath     = PH_SOGO_LOG_FILE tail
+action      = PH_FAIL2BAN_ACTION[name=sogo, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]
+              banned_db[name=sogo, port="PH_FAIL2BAN_DISABLED_SERVICES", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.d/sshd.local

@@ -0,0 +1,8 @@
+[sshd]
+backend     = polling
+journalmatch=
+enabled     = true
+filter      = sshd
+logpath     = PH_SSHD_LOGFILE tail
+action      = PH_FAIL2BAN_ACTION[name=sshd, port="PH_SSHD_PORT", protocol=tcp]
+              banned_db[name=sshd, port="PH_SSHD_PORT", protocol=tcp]

package/dist/server/engine/samples/fail2ban/jail.local

@@ -0,0 +1,6 @@
+[DEFAULT]
+# time is in seconds. 3600 = 1 hour, 86400 = 24 hours (1 day)
+findtime    = 3600
+bantime     = 3600
+maxretry    = 5
+ignoreip    = PH_LOCAL_ADDRESS 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

package/dist/server/engine/samples/fail2ban/openbsd/rc

@@ -0,0 +1,27 @@
+#!/bin/ksh
+ 
+daemon="/usr/local/bin/fail2ban-server"
+ 
+. /etc/rc.d/rc.subr
+ 
+rc_bg=YES
+rc_reload=NO
+ 
+rc_pre() {
+    install -d -o root -m 0700 /var/run/fail2ban
+}
+ 
+rc_start() {
+    # FYI https://github.com/fail2ban/fail2ban/issues/3923
+    nohup ${daemon} -xf start ${daemon_flags} &
+}
+ 
+rc_check() {
+    pgrep -q -f "fail2ban-server"
+}
+ 
+rc_stop() {
+    ${rcexec} ${daemon} -x stop
+}
+ 
+rc_cmd $1

package/dist/server/engine/samples/fail2ban/sql/fail2ban.mysql

@@ -0,0 +1,49 @@
+--
+-- Used to store both enabled and disabled jails.
+--
+CREATE TABLE IF NOT EXISTS `jails` (
+    `id` BIGINT(20) UNSIGNED AUTO_INCREMENT,
+    `name` VARCHAR(255) NOT NULL DEFAULT '',
+    `enabled` TINYINT(1) DEFAULT 1,
+    PRIMARY KEY (`id`),
+    UNIQUE INDEX (`name`),
+    INDEX (`enabled`)
+) ENGINE=InnoDB;
+
+--
+-- Used to store banned/unbanned clients
+--
+CREATE TABLE IF NOT EXISTS `banned` (
+    `id` BIGINT(20) UNSIGNED AUTO_INCREMENT,
+    -- Banned client IP address
+    `ip` VARCHAR(46) NOT NULL DEFAULT '',
+    -- A list of banned network ports, separated by comma
+    `ports` VARCHAR(255) NOT NULL DEFAULT '',
+    -- protocol: tcp, udp, ...
+    `protocol` VARCHAR(10) NOT NULL DEFAULT 'tcp',
+    -- Fail2ban jail name
+    `jail` VARCHAR(50) NOT NULL DEFAULT '',
+    -- The server hostname which the ban/unban happens
+    `hostname` VARCHAR(255) NOT NULL DEFAULT '',
+    `country` VARCHAR(50) NOT NULL DEFAULT '',
+    -- reverse DNS name of banned IP address.
+    `rdns` VARCHAR(255) NOT NULL DEFAULT '',
+    -- number of times the failure occurred in the log file.
+    -- we use Fail2ban action tag `ipjailfailures` here.
+    `failures` INT(2) NOT NULL DEFAULT 0,
+    -- matched log lines.
+    -- we use Fail2ban action tag `ipjailmatches` here.
+    `loglines` TEXT,
+    -- When the ban happens
+    `timestamp` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    -- if `remove=1`, `ip` will be removed by cron job.
+    `remove` TINYINT(1) DEFAULT 0,
+    PRIMARY KEY (`id`),
+    UNIQUE INDEX (`ip`, `ports`, `protocol`),
+    INDEX (`hostname`),
+    INDEX (`rdns`),
+    INDEX (`jail`),
+    INDEX (`country`),
+    INDEX (`timestamp`),
+    INDEX (`remove`)
+) ENGINE=InnoDB;

package/dist/server/engine/samples/fail2ban/sql/fail2ban.pgsql

@@ -0,0 +1,48 @@
+--
+-- Used to store both enabled and disabled jails.
+--
+CREATE TABLE jails (
+    id SERIAL PRIMARY KEY,
+    name VARCHAR(255) NOT NULL DEFAULT '',
+    enabled INT2 DEFAULT 1
+);
+CREATE UNIQUE INDEX idx_jails_name      ON jails (name);
+CREATE        INDEX idx_jails_enabled   ON jails (enabled);
+
+--
+-- Used to store banned/unbanned clients
+--
+CREATE TABLE banned (
+    id SERIAL PRIMARY KEY,
+    -- Banned client IP address
+    ip VARCHAR(46) NOT NULL DEFAULT '',
+    -- A list of banned network ports, separated by comma
+    ports VARCHAR(255) NOT NULL DEFAULT '',
+    -- protocol: tcp, udp, ...
+    protocol VARCHAR(10) NOT NULL DEFAULT 'tcp',
+    -- Fail2ban jail name
+    jail VARCHAR(50) NOT NULL DEFAULT '',
+    -- The server hostname which the ban/unban happens
+    hostname VARCHAR(255) NOT NULL DEFAULT '',
+    country VARCHAR(50) NOT NULL DEFAULT '',
+    -- reverse DNS name of banned IP address.
+    rdns VARCHAR(255) NOT NULL DEFAULT '',
+    -- number of times the failure occurred in the log file.
+    -- we use Fail2ban action tag `ipjailfailures` here.
+    failures SMALLINT NOT NULL DEFAULT 0,
+    -- matched log lines.
+    -- we use Fail2ban action tag `ipjailmatches` here.
+    loglines TEXT,
+    -- When the ban happens
+    timestamp TIMESTAMP WITHOUT TIME ZONE NOT NULL DEFAULT (CURRENT_TIMESTAMP(0) AT TIME ZONE 'UTC'),
+    -- if `remove=1`, `ip` will be removed by cron job.
+    remove INT2 DEFAULT 0
+);
+
+CREATE UNIQUE INDEX idx_banned_ip_ports_protocol ON banned (ip, ports, protocol);
+CREATE INDEX idx_banned_jail ON banned (jail);
+CREATE INDEX idx_banned_hostname ON banned (hostname);
+CREATE INDEX idx_banned_country ON banned (country);
+CREATE INDEX idx_banned_timestamp ON banned (timestamp);
+CREATE INDEX idx_banned_remove ON banned (remove);
+CREATE INDEX idx_banned_rdns ON banned (rdns);

package/dist/server/engine/samples/firewall/firewalld/services/ssh.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<service>
+  <short>SSH</short>
+  <description>Secure Shell (SSH) is a protocol for logging into and executing commands on remote machines. It provides secure encrypted communications. If you plan on accessing your machine remotely via SSH over a firewalled interface, enable this option. You need the openssh-server package installed for this option to be useful.</description>
+  <port protocol="tcp" port="22"/>
+</service>

package/dist/server/engine/samples/firewall/firewalld/zones/iredmail.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<zone>
+    <short>Mail services</short>
+    <description>Allow access to mail services from external network.</description>
+    <service name="http"/>
+    <service name="https"/>
+    <service name="smtp"/>
+    <service name="smtp-submission"/>
+    <port port="465" protocol="tcp"/>
+    <service name="pop3"/>
+    <service name="pop3s"/>
+    <service name="imap"/>
+    <service name="imaps"/>
+    <service name="ssh"/>
+</zone>