lbailly/infrastructure
1
0
Fork 0
forked from DGNum/infrastructure
Code Pull requests Activity

feat(fail2ban): Add preauth jail and enable on storage01

Browse source
This commit is contained in:
Tom Hubrecht 2024-01-05 16:10:06 +01:00
parent a7b492373f
commit 03d4fd3982
2 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
machines/storage01/_configuration.nix
View file

@ -3,6 +3,7 @@
lib.extra.mkConfig { lib.extra.mkConfig {
enabledModules = [ enabledModules = [
# List of modules to enable # List of modules to enable
"dgn-fail2ban"
"dgn-web" "dgn-web"
]; ];
@ -17,6 +18,8 @@ lib.extra.mkConfig {
]; ];
extraConfig = { extraConfig = {
dgn-fail2ban.jails.sshd-preauth.enabled = true;
dgn-hardware.useZfs = true; dgn-hardware.useZfs = true;
dgn-runners.enable = true; dgn-runners.enable = true;

12
modules/dgn-fail2ban/jails.nix
View file

@ -68,6 +68,18 @@ _: {
}; };
}; };
sshd-preauth = {
filter.Definition = {
failregex = "Received disconnect from <ADDR> port .* Bye Bye \\[preauth\\]$";
journalmatch = "_SYSTEMD_UNIT=sshd.service";
};
settings = {
findtime = 600;
maxretry = 1;
};
};
sshd-timeout = { sshd-timeout = {
filter.Definition = { filter.Definition = {
failregex = "fatal: Timeout before authentication for <ADDR>.*$"; failregex = "fatal: Timeout before authentication for <ADDR>.*$";