Feature/removing junk (#129)
* removing fail2ban jails * removed gitea seting and renamed security.nix to endlessh.nix * fixed formating --------- Co-authored-by: Your Name <you@example.com>
This commit is contained in:
parent
e5daa66460
commit
1567d5f296
@ -1,21 +1,7 @@
|
||||
# BIASED
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
config = {
|
||||
services = {
|
||||
openssh = lib.mkIf config.services.gitea.enable {
|
||||
extraConfig = ''
|
||||
Match User gitea
|
||||
PermitTTY no
|
||||
X11Forwarding no
|
||||
'';
|
||||
};
|
||||
|
||||
gitea.settings."ssh.minimum_key_sizes" = lib.mkIf config.services.gitea.enable {
|
||||
ECDSA = -1;
|
||||
RSA = 4095;
|
||||
};
|
||||
|
||||
endlessh-go = lib.mkIf (!builtins.elem 22 config.services.openssh.ports) {
|
||||
enable = true;
|
||||
port = 22;
|
@ -20,27 +20,5 @@ in
|
||||
maxtime = "168h";
|
||||
overalljails = true;
|
||||
};
|
||||
|
||||
jails = {
|
||||
apache-nohome-iptables.settings = {
|
||||
# Block an IP address if it accesses a non-existent
|
||||
# home directory more than 5 times in 10 minutes,
|
||||
# since that indicates that it's scanning.
|
||||
filter = "apache-nohome";
|
||||
action = ''iptables-multiport[name=HTTP, port="http,https"]'';
|
||||
logpath = "/var/log/httpd/error_log*";
|
||||
backend = "systemd";
|
||||
findtime = 600;
|
||||
bantime = 600;
|
||||
maxretry = 5;
|
||||
};
|
||||
|
||||
dovecot = {
|
||||
settings = {
|
||||
filter = "dovecot[mode=aggressive]";
|
||||
maxretry = 3;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
Loading…
x
Reference in New Issue
Block a user