diff --git a/README.md b/README.md index 7685a7a..2a00126 100644 --- a/README.md +++ b/README.md @@ -22,7 +22,7 @@ go build . Alternatively, you can use the [docker image](https://hub.docker.com/r/shizunge/endlessh-go): ``` -sudo docker run -d -p 2222:2222 shizunge/endlessh-go -logtostderr -v=1 +docker run -d -p 2222:2222 shizunge/endlessh-go -logtostderr -v=1 ``` It listens to port `2222` by default. @@ -50,7 +50,7 @@ Usage of ./endlessh-go -enable_prometheus Enable prometheus -geoip_supplier string - Supplier to obtain Geohash of IPs. Possible values are "off", "ip-api", "freegeoip", "max-mind-db" (default "off") + Supplier to obtain Geohash of IPs. Possible values are "off", "ip-api", "max-mind-db" (default "off") -host string SSH listening address (default "0.0.0.0") -interval_ms int @@ -102,7 +102,7 @@ It listens to port `2112` and entry point is `/metrics` by default. The port and The endlessh-go server stores the geohash of attackers as a label on `endlessh_client_open_count`, which is also off by default. You can turn it on via the CLI argument `-geoip_supplier`. The endlessh-go uses service from [ip-api](https://ip-api.com/), which may enforce a query rate and limit commercial use. Visit their website for their terms and policies. -You could also use an offline GeoIP database from [MaxMind](https://www.maxmind.com) by setting `-geoip_supplier` to *max-mind-db* and `-max_mind_db` to the path of the database file. +You could also use an offline GeoIP database from [MaxMind](https://www.maxmind.com) by setting `-geoip_supplier` to _max-mind-db_ and `-max_mind_db` to the path of the database file. ## Dashboard @@ -114,7 +114,6 @@ The dashboard visualizes data for the selected time range. The IP addresses are clickable and link you to the [ARIN](https://www.arin.net/) database. - ## Contacts If you have any problems or questions, please contact me through a [GitHub issue](https://github.com/shizunge/endlessh-go/issues) diff --git a/examples/README.md b/examples/README.md index 58ab558..50c95f1 100644 --- a/examples/README.md +++ b/examples/README.md @@ -1,6 +1,19 @@ # Examples +> The default container user has uid 65534. + ## docker-simple An example how to setup endlessh-go, Prometheus, and Grafana using [docker compose](https://docs.docker.com/compose/). +## docker-maxmind + +An example how to setup endlessh-go with the Maxmind GeoIP Database. + +### Using privileged ports (<1024) on docker + +If you want to run the image with privileged ports (below 1025), you need to set the container user to root: + +```yml +user: root +``` diff --git a/examples/docker-maxmind/README.md b/examples/docker-maxmind/README.md new file mode 100644 index 0000000..3dff00d --- /dev/null +++ b/examples/docker-maxmind/README.md @@ -0,0 +1,16 @@ +## docker compose + +This is an example how to setup endlessh-go with the Maxmind GeoIP Database using [docker compose](https://docs.docker.com/compose/). The reference of the compose file can be found [here](https://docs.docker.com/compose/compose-file/). + +To start the stack, in the _examples_ folder, run: + +``` +sudo docker-compose up -d +``` + +The GeoIP Database will be saved in a mounted volume in: `./geo-data`. And the endlessh-go container will use this database to do the location lookups. + +This example exposes the following ports. Except the SSH port, you should not expose other ports to public without protections (not included in this example) in production. + +- **2222**: The SSH port. You may test endlessh-go by running `ssh -p 2222 localhost`. Your SSH client should hang. View the log of endlessh-go by running `sudo docker logs endlessh`. +- **2112**: The Prometheus metrics exported by endlessh-go. Go to [http://localhost:2112/metrics](http://localhost:2112/metrics) in your web browser to view the metrics. diff --git a/examples/docker-maxmind/docker-compose.yml b/examples/docker-maxmind/docker-compose.yml new file mode 100644 index 0000000..c5fd7a7 --- /dev/null +++ b/examples/docker-maxmind/docker-compose.yml @@ -0,0 +1,36 @@ +version: "3" +services: + + endlessh: + container_name: endlessh + image: shizunge/endlessh-go:latest + restart: unless-stopped + #user: root + command: + - "-logtostderr" + - "-v=1" + - "-geoip_supplier=max-mind-db" + - "-max_mind_db=/geo-data/GeoLite2-City.mmdb" + networks: + - example_network + ports: + - 2222:2222 # SSH port + - 127.0.0.1:2112:2112 # Prometheus metrics port + volumes: + - ./geo-data/:/geo-data/:ro # geoip data + + geoipupdate: + image: ghcr.io/maxmind/geoipupdate:v5 + container_name: geoipupdate + restart: unless-stopped + security_opt: [ "no-new-privileges:true" ] + volumes: + - ./geo-data/:/usr/share/GeoIP/ + environment: + - GEOIPUPDATE_EDITION_IDS=GeoLite2-City + - GEOIPUPDATE_FREQUENCY=72 + - GEOIPUPDATE_ACCOUNT_ID=xxxxxx + - GEOIPUPDATE_LICENSE_KEY=xxxxxx + +networks: + example_network: diff --git a/examples/docker-simple/docker-compose.yml b/examples/docker-simple/docker-compose.yml index 3d0185a..b711fd5 100644 --- a/examples/docker-simple/docker-compose.yml +++ b/examples/docker-simple/docker-compose.yml @@ -1,5 +1,6 @@ version: '3.5' services: + endlessh: container_name: endlessh image: shizunge/endlessh-go:latest @@ -13,16 +14,14 @@ services: networks: - example_network ports: - # SSH port - - 2222:2222 - # Prometheus metrics port - - 127.0.0.1:2112:2112 + - 2222:2222 # SSH port + - 127.0.0.1:2112:2112 # Prometheus metrics port prometheus: image: prom/prometheus:latest container_name: prometheus restart: always - command: + command: - --config.file=/etc/prometheus/prometheus.yml - --storage.tsdb.path=/prometheus - --storage.tsdb.retention.time=45d @@ -55,6 +54,7 @@ services: networks: example_network: + volumes: prometheus: grafana_var: