machines/losurdo/fail2ban.nix

   1 { pkgs, lib, config, machines, ... }:
   2 {
   3 #services.sshd.logLevel = "VERBOSE";
   4 services.postgresql.extraConfig = "log_line_prefix = '%h '";
   5 /*
   6 systemd.services.nftables.postStart = '' systemctl reload fail2ban '';
   7 */
   8 services.fail2ban = {
   9   enable = true;
  10   banaction = "nftables-multiport";
  11   banaction-allports = "nftables-allports";
  12   bantime-increment = {
  13     enable = true;
  14     factor = "1";
  15     formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
  16     maxtime = "1y";
  17     multipliers = "";
  18     overalljails = false;
  19     rndtime = "";
  20   };
  21   packageFirewall = pkgs.nftables;
  22   ignoreIP = [
  23     machines.mermet.extraArgs.ipv4
  24     machines.losurdo.extraArgs.ipv4
  25     "198.252.154.1" # wren.riseup.net
  26   ];
  27   jails = {
  28     DEFAULT = ''
  29     '';
  30     sshd = ''
  31       enabled = true
  32       bantime = 5m
  33       findtime = 1d
  34       maxretry = 1
  35       mode = aggressive
  36     '';
  37     postgresql = ''
  38       enabled = true
  39       bantime = 1m
  40       filter = postgresql
  41       findtime = 1d
  42       port = 5432
  43     '';
  44   };
  45 };
  46 environment.etc."fail2ban/action.d/nftables-common.local".text = ''
  47   [Init]
  48   blocktype = drop
  49 '';
  50 environment.etc."fail2ban/filter.d/postgresql.local".text = ''
  51   [INCLUDES]
  52   before = common.conf
  53   [DEFAULT]
  54   _daemon = postgresql-start
  55   [Definition]
  56   journalmatch = _SYSTEMD_UNIT=postgresql.service + _COMM=postgres
  57   prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID><F-CONTENT>.+</F-CONTENT>$
  58   failregex = ^<HOST>\s+FATAL:\s*no pg_hba.conf entry for host.+$
  59               ^<HOST>\s+FATAL:\s*no PostgreSQL user name specified in startup packet.+$
  60               ^<HOST>\s+FATAL:\s*password authentication failed for user.+$
  61               ^<HOST>\s+FATAL:\s*unsupported frontend protocol.+$
  62   maxlines = 1
  63   #ignoreregex = duration:
  64 '';
  65 }