diff options
| author | ene <ene@sils.li> | 2023-03-25 14:01:38 +0100 |
|---|---|---|
| committer | ene <ene@sils.li> | 2023-03-25 14:01:38 +0100 |
| commit | e8be6a5d243e3ff0e8c4544bfd654a6e56da07f8 (patch) | |
| tree | abc2293c6d126a6d87d49ef0b0eb6ffabc3fe263 /system | |
| parent | Merge pull request 'Feat(system/services/fail2ban): Add fail2ban' (#23) from ... (diff) | |
| parent | Feat(system/services/fail2ban): Add dovecot jail (diff) | |
| download | nixos-server-e8be6a5d243e3ff0e8c4544bfd654a6e56da07f8.tar.gz nixos-server-e8be6a5d243e3ff0e8c4544bfd654a6e56da07f8.zip | |
Merge pull request 'server1_fail2ban' (#24) from server1_fail2ban into server1_develop
Reviewed-on: https://git.sils.li/vhack.eu/nixos-server/pulls/24
Diffstat (limited to 'system')
| -rw-r--r-- | system/services/fail2ban/default.nix | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/system/services/fail2ban/default.nix b/system/services/fail2ban/default.nix index 5b5e9e7..5aee097 100644 --- a/system/services/fail2ban/default.nix +++ b/system/services/fail2ban/default.nix @@ -3,6 +3,13 @@ services.fail2ban = { enable = true; maxretry = 2; # ban after 2 failures + daemonConfig = '' + [Definition] + logtarget = SYSLOG + socket = /run/fail2ban/fail2ban.sock + pidfile = /run/fail2ban/fail2ban.pid + dbfile = /srv/fail2ban/fail2ban.sqlite3 + ''; bantime-increment = { enable = true; rndtime = "8m"; @@ -10,5 +17,14 @@ multipliers = "2 4 16 128 256"; maxtime = "72h"; }; + jails = { + dovecot = '' + # block IPs which failed to log-in + # aggressive mode add blocking for aborted connections + enabled = true + filter = dovecot[mode=aggressive] + maxretry = 2 + ''; + }; }; } |