initial commit

jail.local.j2

@@ -0,0 +1,44 @@
+# --------------------------------------------------------------
+# Fail2Ban jail.local - default settings for Fedora 44
+# Values like {{ fail2ban_port }} come from the playbook vars
+# --------------------------------------------------------------
+
+[DEFAULT]
+# Ban IPs after maxretry failures for bantime seconds
+bantime  = {{ fail2ban_bantime }}
+maxretry = {{ fail2ban_maxretry }}
+# Raise ban time incrementally for repeat offenders
+bantime.increment = true
+bantime.factor    = 2
+bantime.maxtime   = 24h
+
+# --------------------------------------------------------------
+# SSH jail - protects against brute-force login attempts
+# --------------------------------------------------------------
+[sshd]
+enabled  = true
+port     = {{ fail2ban_port }}
+filter   = sshd
+logpath  = /var/log/secure
+backend  = systemd
+maxretry = {{ fail2ban_maxretry }}
+bantime  = {{ fail2ban_bantime }}
+
+# --------------------------------------------------------------
+# HTTP auth jail - uncomment if you run a web server
+# --------------------------------------------------------------
+#[http-auth]
+#enabled  = true
+#port     = http,https
+#filter   = http-auth
+#logpath  = /var/log/nginx/access.log
+#maxretry = {{ fail2ban_maxretry }}
+#bantime  = {{ fail2ban_bantime }}
+
+# --------------------------------------------------------------
+# Add more jails below as needed, e.g.:
+# [vsftpd]  - FTP brute force
+# [postfix] - mail smtp auth failures
+# [dovecot] - IMAP/POP3 brute force
+# Each jail needs: enabled = true, filter, logpath
+# --------------------------------------------------------------