Feature/removing junk (#129)
* removing fail2ban jails * removed gitea seting and renamed security.nix to endlessh.nix * fixed formating --------- Co-authored-by: Your Name <you@example.com>
This commit is contained in:
parent
e5daa66460
commit
1567d5f296
@ -1,21 +1,7 @@
|
|||||||
# BIASED
|
|
||||||
{ config, lib, ... }:
|
{ config, lib, ... }:
|
||||||
{
|
{
|
||||||
config = {
|
config = {
|
||||||
services = {
|
services = {
|
||||||
openssh = lib.mkIf config.services.gitea.enable {
|
|
||||||
extraConfig = ''
|
|
||||||
Match User gitea
|
|
||||||
PermitTTY no
|
|
||||||
X11Forwarding no
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
gitea.settings."ssh.minimum_key_sizes" = lib.mkIf config.services.gitea.enable {
|
|
||||||
ECDSA = -1;
|
|
||||||
RSA = 4095;
|
|
||||||
};
|
|
||||||
|
|
||||||
endlessh-go = lib.mkIf (!builtins.elem 22 config.services.openssh.ports) {
|
endlessh-go = lib.mkIf (!builtins.elem 22 config.services.openssh.ports) {
|
||||||
enable = true;
|
enable = true;
|
||||||
port = 22;
|
port = 22;
|
@ -20,27 +20,5 @@ in
|
|||||||
maxtime = "168h";
|
maxtime = "168h";
|
||||||
overalljails = true;
|
overalljails = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
jails = {
|
|
||||||
apache-nohome-iptables.settings = {
|
|
||||||
# Block an IP address if it accesses a non-existent
|
|
||||||
# home directory more than 5 times in 10 minutes,
|
|
||||||
# since that indicates that it's scanning.
|
|
||||||
filter = "apache-nohome";
|
|
||||||
action = ''iptables-multiport[name=HTTP, port="http,https"]'';
|
|
||||||
logpath = "/var/log/httpd/error_log*";
|
|
||||||
backend = "systemd";
|
|
||||||
findtime = 600;
|
|
||||||
bantime = 600;
|
|
||||||
maxretry = 5;
|
|
||||||
};
|
|
||||||
|
|
||||||
dovecot = {
|
|
||||||
settings = {
|
|
||||||
filter = "dovecot[mode=aggressive]";
|
|
||||||
maxretry = 3;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
Loading…
x
Reference in New Issue
Block a user