44 lines
1.5 KiB
Django/Jinja
44 lines
1.5 KiB
Django/Jinja
# --------------------------------------------------------------
|
|
# Fail2Ban jail.local - default settings for Fedora 44
|
|
# Values like {{ fail2ban_port }} come from the playbook vars
|
|
# --------------------------------------------------------------
|
|
|
|
[DEFAULT]
|
|
# Ban IPs after maxretry failures for bantime seconds
|
|
bantime = {{ fail2ban_bantime }}
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
# Raise ban time incrementally for repeat offenders
|
|
bantime.increment = true
|
|
bantime.factor = 2
|
|
bantime.maxtime = 24h
|
|
|
|
# --------------------------------------------------------------
|
|
# SSH jail - protects against brute-force login attempts
|
|
# --------------------------------------------------------------
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ fail2ban_port }}
|
|
filter = sshd
|
|
logpath = /var/log/secure
|
|
backend = systemd
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
bantime = {{ fail2ban_bantime }}
|
|
|
|
# --------------------------------------------------------------
|
|
# HTTP auth jail - uncomment if you run a web server
|
|
# --------------------------------------------------------------
|
|
#[http-auth]
|
|
#enabled = true
|
|
#port = http,https
|
|
#filter = http-auth
|
|
#logpath = /var/log/nginx/access.log
|
|
#maxretry = {{ fail2ban_maxretry }}
|
|
#bantime = {{ fail2ban_bantime }}
|
|
|
|
# --------------------------------------------------------------
|
|
# Add more jails below as needed, e.g.:
|
|
# [vsftpd] - FTP brute force
|
|
# [postfix] - mail smtp auth failures
|
|
# [dovecot] - IMAP/POP3 brute force
|
|
# Each jail needs: enabled = true, filter, logpath
|
|
# -------------------------------------------------------------- |