nixos/services/fail2ban.nix

95 lines
2.6 KiB
Nix
Raw Normal View History

{ config, lib, ... }:
2019-02-26 13:44:40 +01:00
with lib;
2019-09-06 11:39:24 +02:00
let
cfg = config.machine;
active = name: (elem name cfg.services);
in mkIf (elem "fail2ban" cfg.services) {
2019-02-26 13:44:40 +01:00
services.fail2ban = {
enable = true;
jails = {
DEFAULT = ''
bantime = 3600
ignoreip = 127.0.0.1
2019-09-06 11:39:24 +02:00
blocktype = DROP
2019-02-26 13:44:40 +01:00
logpath = /var/log/auth.log
'';
ssh = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "openssh")}
2019-02-26 13:44:40 +01:00
filter = sshd
maxretry = 4
action = iptables[name=SSH, port=ssh, protocol=tcp]
'';
sshd-ddos = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "openssh")}
2019-02-26 13:44:40 +01:00
filter = sshd-ddos
2019-09-06 11:39:24 +02:00
maxretry = 4
2019-02-26 13:44:40 +01:00
action = iptables[name=ssh, port=ssh, protocol=tcp]
'';
postfix = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "mailserver")}
2019-02-26 13:44:40 +01:00
filter = postfix
maxretry = 3
action = iptables[name=postfix, port=smtp, protocol=tcp]
'';
postfix-sasl = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "mailserver")}
2019-02-26 13:44:40 +01:00
filter = postfix-sasl
2019-09-06 11:39:24 +02:00
port = postfix,imap3,imaps,pop3,pop3s
2019-02-26 13:44:40 +01:00
maxretry = 3
action = iptables[name=postfix, port=smtp, protocol=tcp]
'';
postfix-ddos = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "mailserver")}
2019-02-26 13:44:40 +01:00
filter = postfix-ddos
maxretry = 3
action = iptables[name=postfix, port=submission, protocol=tcp]
bantime = 7200
'';
nginx-req-limit = ''
2019-09-06 11:39:24 +02:00
enabled = ${boolToString (active "nginx")}
2019-02-26 13:44:40 +01:00
filter = nginx-req-limit
maxretry = 10
action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
findtime = 600
bantime = 7200
'';
2019-02-26 13:44:40 +01:00
};
};
2019-09-06 11:39:24 +02:00
environment.etc."fail2ban/filter.d/postfix-sasl.conf" = {
enable = (active "mailserver");
text = ''
# Fail2Ban filter for postfix authentication failures
[INCLUDES]
before = common.conf
[Definition]
daemon = postfix/smtpd
failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
'';
};
environment.etc."fail2ban/filter.d/postfix-ddos.conf" = {
enable = (active "mailserver");
text = ''
[Definition]
failregex = lost connection after EHLO from \S+\[<HOST>\]
'';
};
2019-02-26 13:44:40 +01:00
2019-09-06 11:39:24 +02:00
environment.etc."fail2ban/filter.d/nginx-req-limit.conf" = {
enable = (active "nginx");
text = ''
[Definition]
failregex = limiting requests, excess:.* by zone.*client: <HOST>
'';
};
2019-02-26 13:44:40 +01:00
# Limit stack size to reduce memory usage
systemd.services.fail2ban.serviceConfig.LimitSTACK = 256 * 1024;
}