aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

fail2ban: speed up gitea/bitwarden jails

Browse source 
These services log to syslog, so a log file doesn't exist, meaning
fail2ban must scan the whole journal to seek authentication failure
logs, which is slow! By specifying a journalmatch, it significantly
narrows the scope of their searches.
This commit is contained in:
Henrik Lissner 2021-01-30 05:06:31 -05:00
parent 0fb9406b75
commit 2da00f3ad5
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/services/fail2ban.nix
View file

@ -35,11 +35,13 @@ in {
[Definition]
failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =
journalmatch = _SYSTEMD_UNIT=bitwarden_rs.service
'';
"fail2ban/filter.d/gitea.conf".text = ''
[Definition]
failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>
ignoreregex =
journalmatch = _SYSTEMD_UNIT=gitea.service
'';
};
};

3
modules/services/gitea.nix
View file

@ -26,7 +26,7 @@ in {
# We're assuming SSL-only connectivity
cookieSecure = true;
# Only log what's important
# Only log what's important, but Info is necessary for fail2ban to work
log.level = "Info";
settings.server.DISABLE_ROUTER_LOG = true;
};
@ -34,7 +34,6 @@ in {
services.fail2ban.jails.gitea = ''
enabled = true
filter = gitea
logpath = ${config.services.gitea.log.rootPath}/gitea.log
banaction = %(banaction_allports)s
'';