# --------------------------------------------------------------
# Fail2Ban jail.local - default settings for Fedora 44
# Values like {{ fail2ban_port }} come from the playbook vars
# --------------------------------------------------------------

[DEFAULT]
# Ban IPs after maxretry failures for bantime seconds
bantime  = {{ fail2ban_bantime }}
maxretry = {{ fail2ban_maxretry }}
# Raise ban time incrementally for repeat offenders
bantime.increment = true
bantime.factor    = 2
bantime.maxtime   = 24h

# --------------------------------------------------------------
# SSH jail - protects against brute-force login attempts
# --------------------------------------------------------------
[sshd]
enabled  = true
port     = {{ fail2ban_port }}
filter   = sshd
logpath  = /var/log/secure
backend  = systemd
maxretry = {{ fail2ban_maxretry }}
bantime  = {{ fail2ban_bantime }}

# --------------------------------------------------------------
# HTTP auth jail - uncomment if you run a web server
# --------------------------------------------------------------
#[http-auth]
#enabled  = true
#port     = http,https
#filter   = http-auth
#logpath  = /var/log/nginx/access.log
#maxretry = {{ fail2ban_maxretry }}
#bantime  = {{ fail2ban_bantime }}

# --------------------------------------------------------------
# Add more jails below as needed, e.g.:
# [vsftpd]  - FTP brute force
# [postfix] - mail smtp auth failures
# [dovecot] - IMAP/POP3 brute force
# Each jail needs: enabled = true, filter, logpath
# --------------------------------------------------------------