49 lines
2.7 KiB
Plaintext
49 lines
2.7 KiB
Plaintext
[INCLUDES]
|
|
|
|
before = paths-arch.conf
|
|
|
|
[DEFAULT]
|
|
|
|
# Never act on the machine itself or on a tunnel peer: the mesh's private range is
|
|
# ${machine:mesh-range}, named here rather than written as a value the module cannot
|
|
# know (novox/hq ADR 0112). Without this, fail2ban could ban the mesh's own nodes.
|
|
# **A ban list never holds a neighbour.** The mesh's own range is named rather than written
|
|
# (novox/hq ADR 0112), and every private range beside it: a source on one is somebody's own
|
|
# network, not the internet. On a machine behind a router that reflects local traffic, every
|
|
# client in the house arrives as the gateway's address — so one mistyped local request banned
|
|
# 192.168.1.1 on the home server and would have cut the whole house off from it (ADR 0186).
|
|
#
|
|
# **Nor the operator's own addresses** (novox/hq ADR 0339, issue 238): the public addresses the operator names
|
|
# as theirs, in the mesh-wide setting own-addresses. An agent polling the forge from the operator's home banned
|
|
# that home for four weeks on 2026-10-04, and nothing in the house reached the control-node until it was found
|
|
# among 400 bans. The file is written by this module's watch from the setting, one entry per line; fail2ban
|
|
# reads it again within a second of a change, so a new value needs no restart. Empty until the operator
|
|
# fills the setting. A jail that sets its own ignoreip leaves all of this out; the watch says so.
|
|
ignoreip = 127.0.0.1/8 ::1 ${machine:mesh-range} 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 169.254.0.0/16 fc00::/7 fe80::/10 file:/var/lib/mesh-fail2ban/own-addresses
|
|
|
|
# Three failures in a day ban for a day (novox/hq ADR 0179). The attackers this mesh sees pace
|
|
# themselves at one try every ten minutes, under any ten-minute window; a day's window counts
|
|
# them, and a day's ban costs a person who mistyped three times once, from one address, while
|
|
# the mesh's own range is never banned at all.
|
|
bantime = 1d
|
|
findtime = 1d
|
|
maxretry = 3
|
|
|
|
# Ban through iptables, not through a firewall front-end the machine may not have. ufw is
|
|
# installed on two of this mesh's machines and absent on the other two, and fail2ban finds out
|
|
# only at ban time: the service reports healthy, the jail counts the attempt, the ban command
|
|
# exits 127, and nothing is blocked. Proven on 2026-09-28 -- 'ufw: command not found' on a
|
|
# machine the mesh reported as protected.
|
|
#
|
|
# The action below is this module's own, already used by the recidive jail on every machine
|
|
# here, and it bans in DOCKER-USER as well as INPUT, so a container's published port is
|
|
# covered too.
|
|
banaction = iptables-allports-dualchain
|
|
banaction_allports = iptables-allports-dualchain
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
logpath = %(sshd_log)s
|
|
backend = %(sshd_backend)s
|