hosts/losurdo/fail2ban.nix

   1 { pkgs, hosts, ... }:
   2 {
   3   services.openssh.logLevel = "VERBOSE";
   4   services.postgresql.logLinePrefix = "%h ";
   5   /*
   6     systemd.services.nftables.postStart = '' systemctl reload fail2ban '';
   7   */
   8   services.fail2ban = {
   9     enable = true;
  10     banaction = "nftables-multiport";
  11     banaction-allports = "nftables-allports";
  12     bantime-increment = {
  13       enable = true;
  14       factor = "1";
  15       formula = "ban.Time * (1 << min(ban.Count, 20)) * banFactor";
  16       maxtime = "1y";
  17       multipliers = "";
  18       overalljails = false;
  19       rndtime = "";
  20     };
  21     packageFirewall = pkgs.nftables;
  22     ignoreIP = [
  23       #"0.0.0.0/8"
  24       #"10.0.0.0/8"
  25       "127.0.0.0/8"
  26       #"169.254.0.0/16"
  27       #"172.16.0.0/12"
  28       #"192.0.2.0/24"
  29       "192.168.0.0/16"
  30       #"224.0.0.0/3"
  31       #"240.0.0.0/5"
  32       hosts.mermet._module.args.ipv4
  33       "losurdo.sourcephile.fr"
  34     ];
  35     jails = {
  36       DEFAULT = ''
  37     '';
  38       sshd = ''
  39         enabled = true
  40         bantime = 5m
  41         findtime = 1d
  42         maxretry = 1
  43         mode = aggressive
  44       '';
  45       postgresql = ''
  46         enabled = true
  47         bantime = 1m
  48         filter = postgresql
  49         findtime = 1d
  50         port = 5432
  51       '';
  52     };
  53   };
  54   environment.etc."fail2ban/action.d/nftables-common.local".text = ''
  55     [Init]
  56     blocktype = drop
  57   '';
  58   environment.etc."fail2ban/filter.d/postgresql.local".text = ''
  59     [INCLUDES]
  60     before = common.conf
  61     [DEFAULT]
  62     _daemon = postgresql-start
  63     [Definition]
  64     journalmatch = _SYSTEMD_UNIT=postgresql.service + _COMM=postgres
  65     prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID><F-CONTENT>.+</F-CONTENT>$
  66     failregex = ^<HOST>\s+FATAL:\s*no pg_hba.conf entry for host.+$
  67                 ^<HOST>\s+FATAL:\s*no PostgreSQL user name specified in startup packet.+$
  68                 ^<HOST>\s+FATAL:\s*password authentication failed for user.+$
  69                 ^<HOST>\s+FATAL:\s*unsupported frontend protocol.+$
  70     maxlines = 1
  71     #ignoreregex = duration:
  72   '';
  73 }