gortium/infra
1
1
Fork 0
Code Issues 13 Pull Requests 21 Actions Packages Projects 1 Releases Wiki Activity

fix: add custom traefik fail2ban filters for http-auth and http-botsearch jails

Browse Source
This commit is contained in:
Hermes Agent
2026-05-01 03:03:08 +00:00
parent ed7852ac08
commit ceaf470f8a
1 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
hosts/lazyworkhorse/configuration.nix
View File

@@ -372,30 +372,29 @@
}; };
jails = { jails = {
# SSH brute force protection # SSH brute force protection (uses systemd journal backend)
sshd = { sshd = {
enabled = true; enabled = true;
filter = "sshd"; filter = "sshd";
port = "2424"; port = "2424";
logpath = "/var/log/auth.log";
maxretry = 3; maxretry = 3;
bantime = 3600; bantime = 3600;
}; };
# HTTP authentication failures # HTTP authentication failures (Traefik)
http-auth = { http-auth = {
enabled = true; enabled = true;
filter = "apache-auth"; filter = "traefik-auth";
port = "80,443"; port = "80,443";
logpath = "/var/log/traefik/access.log"; logpath = "/var/log/traefik/access.log";
maxretry = 5; maxretry = 5;
bantime = 3600; bantime = 3600;
}; };
# HTTP scanning/attacks # HTTP scanning/attacks (Traefik)
http-botsearch = { http-botsearch = {
enabled = true; enabled = true;
filter = "apache-botsearch"; filter = "traefik-botsearch";
port = "80,443"; port = "80,443";
logpath = [ "/var/log/traefik/access.log" ]; logpath = [ "/var/log/traefik/access.log" ];
maxretry = 2; maxretry = 2;
@@ -404,6 +403,20 @@
}; };
}; };
# Custom fail2ban filters for Traefik
environment.etc."fail2ban/filter.d/traefik-auth.conf".text = ''
[Definition]
failregex = ^<HOST> -.*"(GET|POST|HEAD|PUT|DELETE).*" (401|403) \d+.*$
ignoreregex =
'';
environment.etc."fail2ban/filter.d/traefik-botsearch.conf".text = ''
[Definition]
failregex = ^<HOST> -.*"(GET|POST|HEAD|PUT|DELETE).*" 404 \d+.*$
^<HOST> -.*"(GET|POST|HEAD|PUT|DELETE).*/(\.|wp-|php|admin|login|xmlrpc|\.env|\.git|\.aws|\.azure).*" \d+.*$
ignoreregex =
'';
# SSH hardening # SSH hardening
services.openssh.settings = { services.openssh.settings = {
PermitRootLogin = "no"; PermitRootLogin = "no";