services/fail2ban: wip barebonesconfiguration

services/fail2ban.nix

@@ -11,94 +11,98 @@ in
 mkIf (elem "fail2ban" cfg.services) {
   services.fail2ban = {
     enable = true;
+    # Ban IP after 5 failures
+    maxretry = 5;
+    ignoreIP = [
+      "127.0.0.1"
+      "152.53.131.220"
+    ];
+    bantime = "24h"; # Ban IPs for one day on the first ban
+    bantime-increment = {
+      enable = true; # Enable increment of bantime after each violation
+      formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+      maxtime = "672h"; # Do not ban for more than 4 weeks
+      overalljails = true; # Calculate the bantime based on all the violations
+    };
     jails = {
-      DEFAULT = ''
+      sshd = {
-        bantime  = 3600
+        settings = {
-        blocktype = DROP
+          enabled = active "openssh";
-        logpath  = /var/log/auth.log
+          filter = "sshd[mode=normal]";
-      '';
+        };
-
+      };
-      ssh = ''
+      dovecot = {
-        enabled = ${boolToString (active "openssh")}
+        settings = {
-        filter = sshd
+          enabled = active "mailserver";
-        maxretry = 4
+          filter = "dovecot[mode=normal]";
-        action = iptables[name=SSH, port=ssh, protocol=tcp]
+        };
-      '';
+      };
-      sshd-ddos = ''
+      radicale = {
-        enabled  = ${boolToString (active "openssh")}
+        settings = {
-        filter = sshd-ddos
+          enabled = active "radicale";
-        maxretry = 4
+          filter = "radicale";
-        action   = iptables[name=ssh, port=ssh, protocol=tcp]
+          banaction = "%(banaction_allports)s[name=radicale]";
-      '';
+          backend = "systemd";
-
+          journalmatch = "_SYSTEMD_UNIT=radicale.service";
-      postfix = ''
+        };
-        enabled  = ${boolToString (active "mailserver")}
+      };
-        filter   = postfix
+      # ''
-        maxretry = 3
+      #   enabled = ${boolToString (active "openssh")}
-        action   = iptables[name=postfix, port=smtp, protocol=tcp]
+      #   filter = sshd
-      '';
+      #   maxretry = 4
-      postfix-sasl = ''
+      #   action = iptables[name=SSH, port=ssh, protocol=tcp]
-        enabled  = ${boolToString (active "mailserver")}
+      # '';
-        filter   = postfix-sasl
-        port     = postfix,imap3,imaps,pop3,pop3s
-        maxretry = 3
-        action   = iptables[name=postfix, port=smtp, protocol=tcp]
-      '';
-      postfix-ddos = ''
-        enabled  = ${boolToString (active "mailserver")}
-        filter   = postfix-ddos
-        maxretry = 3
-        action   = iptables[name=postfix, port=submission, protocol=tcp]
-        bantime  = 7200
-      '';
-
-      nginx-req-limit = ''
-        enabled = ${boolToString (active "nginx")}
-        filter = nginx-req-limit
-        maxretry = 10
-        action = iptables-multiport[name=ReqLimit, port="http,https", protocol=tcp]
-        findtime = 600
-        bantime = 7200
-      '';
     };
   };
 
-  environment.etc."fail2ban/filter.d/sshd-ddos.conf" = {
+  environment.etc."fail2ban/filter.d/radicale.conf" = {
-    enable = active "openssh";
+    enable = active "radicale";
     text = ''
-      [Definition]
-      failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
-      ignoreregex =
-    '';
-  };
-
-  environment.etc."fail2ban/filter.d/postfix-sasl.conf" = {
-    enable = active "mailserver";
-    text = ''
-      # Fail2Ban filter for postfix authentication failures
       [INCLUDES]
       before = common.conf
-      [Definition]
-      daemon = postfix/smtpd
-      failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
-    '';
-  };
 
-  environment.etc."fail2ban/filter.d/postfix-ddos.conf" = {
-    enable = active "mailserver";
-    text = ''
       [Definition]
-      failregex = lost connection after EHLO from \S+\[<HOST>\]
+      failregex = ^.*Failed\slogin\sattempt\sfrom\s.*\(forwarded for \'<HOST>\'.*\):\s.*
-    '';
-  };
 
-  environment.etc."fail2ban/filter.d/nginx-req-limit.conf" = {
+      [Init]
-    enable = active "nginx";
-    text = ''
-      [Definition]
-      failregex = limiting requests, excess:.* by zone.*client: <HOST>
     '';
   };
+  # environment.etc."fail2ban/filter.d/sshd-ddos.conf" = {
+  #   enable = active "openssh";
+  #   text = ''
+  #     [Definition]
+  #     failregex = sshd(?:\[\d+\])?: Did not receive identification string from <HOST>$
+  #     ignoreregex =
+  #   '';
+  # };
+  #
+  # environment.etc."fail2ban/filter.d/postfix-sasl.conf" = {
+  #   enable = active "mailserver";
+  #   text = ''
+  #     # Fail2Ban filter for postfix authentication failures
+  #     [INCLUDES]
+  #     before = common.conf
+  #     [Definition]
+  #     daemon = postfix/smtpd
+  #     failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
+  #   '';
+  # };
+  #
+  # environment.etc."fail2ban/filter.d/postfix-ddos.conf" = {
+  #   enable = active "mailserver";
+  #   text = ''
+  #     [Definition]
+  #     failregex = lost connection after EHLO from \S+\[<HOST>\]
+  #   '';
+  # };
+  #
+  # environment.etc."fail2ban/filter.d/nginx-req-limit.conf" = {
+  #   enable = active "nginx";
+  #   text = ''
+  #     [Definition]
+  #     failregex = limiting requests, excess:.* by zone.*client: <HOST>
+  #   '';
+  # };
 
   # Limit stack size to reduce memory usage
   systemd.services.fail2ban.serviceConfig.LimitSTACK = 256 * 1024;