fail2ban: speed up gitea/bitwarden jails
These services log to syslog, so a log file doesn't exist, meaning fail2ban must scan the whole journal to seek authentication failure logs, which is slow! By specifying a journalmatch, it significantly narrows the scope of their searches.
This commit is contained in:
		
							parent
							
								
									0fb9406b75
								
							
						
					
					
						commit
						2da00f3ad5
					
				|  | @ -35,11 +35,13 @@ in { | |||
|         [Definition] | ||||
|         failregex = ^.*Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$ | ||||
|         ignoreregex = | ||||
|         journalmatch = _SYSTEMD_UNIT=bitwarden_rs.service | ||||
|       ''; | ||||
|       "fail2ban/filter.d/gitea.conf".text = '' | ||||
|         [Definition] | ||||
|         failregex =  .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST> | ||||
|         ignoreregex = | ||||
|         journalmatch = _SYSTEMD_UNIT=gitea.service | ||||
|       ''; | ||||
|     }; | ||||
|   }; | ||||
|  |  | |||
|  | @ -26,7 +26,7 @@ in { | |||
| 
 | ||||
|       # We're assuming SSL-only connectivity | ||||
|       cookieSecure = true; | ||||
|       # Only log what's important | ||||
|       # Only log what's important, but Info is necessary for fail2ban to work | ||||
|       log.level = "Info"; | ||||
|       settings.server.DISABLE_ROUTER_LOG = true; | ||||
|     }; | ||||
|  | @ -34,7 +34,6 @@ in { | |||
|     services.fail2ban.jails.gitea = '' | ||||
|       enabled = true | ||||
|       filter = gitea | ||||
|       logpath = ${config.services.gitea.log.rootPath}/gitea.log | ||||
|       banaction = %(banaction_allports)s | ||||
|     ''; | ||||
| 
 | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue