aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

Tweak fail2ban defaults

Browse source
This commit is contained in:
Henrik Lissner 2021-01-31 18:20:46 -05:00
parent 68fa845a73
commit c32a1846e0
1 changed files with 10 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
modules/services/fail2ban.nix
View file

@ -13,19 +13,17 @@ in {
enable = true; enable = true;
ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ]; ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
banaction-allports = "iptables-allports"; banaction-allports = "iptables-allports";
jails = { bantime-increment = {
DEFAULT = '' enable = true;
blocktype = DROP maxtime = "168h";
bantime = 6h factor = "4";
findtime = 15m
'';
# Harsher defaults for sshd because it's all key based. Auth failures
# are less likely to be legit here.
sshd = ''
bantime = 24h
findtime = 1h
'';
}; };
jails.DEFAULT = ''
maxretry = 5
blocktype = DROP
bantime = 1h
findtime = 1h
'';
}; };
# Extra filters # Extra filters