gortium/infra
1
1
Fork 0
Code Issues 13 Pull Requests 21 Actions Packages Projects 1 Releases Wiki Activity

fix: restructure fail2ban jails per NixOS module - recidive in jails, settings attr, str bantime

Browse Source
This commit is contained in:
Hermes Agent
2026-05-01 03:59:32 +00:00
parent 2477acdfc7
commit 260b2d2756
1 changed files with 30 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

52
hosts/lazyworkhorse/configuration.nix
View File

@@ -357,47 +357,55 @@
services.fail2ban = { services.fail2ban = {
enable = true; enable = true;
maxretry = 3; maxretry = 3;
bantime = 3600; bantime = "1h";
banaction = "iptables-multiport"; banaction = "iptables-multiport";
# Ban repeat offenders for 1 week
recidive = {
enabled = true;
filter = "recidive";
logpath = "/var/log/fail2ban.log";
bantime = 604800;
findtime = 86400;
maxretry = 3;
};
jails = { jails = {
# SSH brute force protection (uses systemd journal backend) # SSH brute force protection (uses systemd journal backend)
sshd = { sshd = {
enabled = true; enabled = true;
filter = "sshd"; filter = "sshd";
port = "2424"; settings = {
maxretry = 3; port = "2424";
bantime = 3600; maxretry = 3;
bantime = "1h";
};
};
# Recidive - ban repeat offenders for 1 week
recidive = {
enabled = true;
filter = "recidive";
settings = {
logpath = "/var/log/fail2ban.log";
bantime = "1w";
findtime = "1d";
maxretry = 3;
};
}; };
# HTTP authentication failures (Traefik) # HTTP authentication failures (Traefik)
http-auth = { http-auth = {
enabled = true; enabled = true;
filter = "traefik-auth"; filter = "traefik-auth";
port = "80,443"; settings = {
logpath = "/var/log/traefik/access.log"; port = "80,443";
maxretry = 5; logpath = "/var/log/traefik/access.log";
bantime = 3600; maxretry = 5;
bantime = "1h";
};
}; };
# HTTP scanning/attacks (Traefik) # HTTP scanning/attacks (Traefik)
http-botsearch = { http-botsearch = {
enabled = true; enabled = true;
filter = "traefik-botsearch"; filter = "traefik-botsearch";
port = "80,443"; settings = {
logpath = [ "/var/log/traefik/access.log" ]; port = "80,443";
maxretry = 2; logpath = [ "/var/log/traefik/access.log" ];
bantime = 7200; maxretry = 2;
bantime = "2h";
};
}; };
}; };
}; };