What type of hardware are you using: Raspberry Pi 3, 4+ What YunoHost version are you running: 12.0.12 How are you able to access your server: Direct access via physical keyboard/screen Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: Tweaked Fail2Ban to report IP’s to abuseipdb
Describe your issue
I wanted to setup a custom 404 page to harden my security on my server, and make it harder for scriptkiddies to find out my login page. I’ve also configured fail2ban to ban IP’s that are requesting a abnormal amount of 4xx pages, which is the reason i want to set a custon 404 page.
I’ve seen several tutorials to edit a file in /etc/ssowat, but this folder does not exist in my installation. So these tutorials do not work.
Is there something i’m doing completely wrong?
I generally want to keep out bad bots, and prevent skiddies from finding my admin interface. And i want to keep out the occasional AI bots, since i dont want my data to be used to train AI.
So setting up a robots.txt for all my domains would be nice
Keeping bots out of your server => Here’s a hook to be placed in /etc/yunohost/hooks.d/conf_regen/ . You can obviously improve it. This one intend to avoid indexation by search engines like google & co, not to protect server vs malicious bots.
#!/bin/bash
# A placer dans /etc/yunohost/hooks.d/conf_regen/
# Site pour tester les headers : https://headers.4tools.net/
##############################################
#Beware, i'm not sure this command is universal. You must test it before. If not, you can find the result with the command ip route, this one must be like 192.168.0.0/24 or similar. Then replace the variable $network_address with it.
#Attention, je ne suis pas certain que cette commande est universelle. Vous devez la tester au préalable. Si ce n'est pas le cas, vous pouvez trouver la réponse avec la commande ip route, celle-ci doit être de la forme 192.168.0.0/24 ou similaire. Remplacez alors la variable $network_address par celle-ci.
network_address=$(awk '{print $1}' <(grep src <(ip route)))
################################################
action=$1
pending_dir=$4
nginx_dir=$pending_dir/../nginx/etc/nginx
nginx_security_conf=$nginx_dir/conf.d/security.conf.inc
[[ $action == "pre" ]] || exit 0
[[ -d $nginx_dir ]] || exit 0
[[ -e $nginx_security_conf ]] || exit 0
echo '
#Gestion des robots
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive, noimageindex, notranslate";
' >> $nginx_security_conf
BruteForce : fail2ban do the job. You can also parse the logs to re-ban previously banned IP (in case the bot try less often than the findtime configured in F2B). See kit/Purge_IP - Purge_IP - Gitea (old and dirty code, review and improve it). Works with GeoIP, you need to modify it if you don’t Geoblock your server.
Rename : use a name begining with a number and hyphen : 99-filename. Number depends of the order the hooks are launched. Me sure it is executable (chmod +x filename).