VSinerva/nixos-conf
1
0
Fork 0
Code Activity Actions

Add fail2ban SSH protection

Browse source
This commit is contained in:
Vili Sinervä 2024-07-05 16:12:27 +03:00
parent 6b04b535c1
commit 3d4dc62dc9
No known key found for this signature in database
GPG key ID: DF8FEAF54EFAC996
1 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
base.nix
View file

@ -72,12 +72,31 @@
''; '';
#################### SSH configuration #################### #################### SSH configuration ####################
services.openssh.enable = true; services.openssh = {
services.openssh.settings.PasswordAuthentication = false; enable = true;
settings.PasswordAuthentication = false;
};
users.users.root.openssh.authorizedKeys.keys = [ users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBbGREoK1uVny1s8FK3KZ74Wmaf0VtifhqPyK69C/Gez vili@helium" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBbGREoK1uVny1s8FK3KZ74Wmaf0VtifhqPyK69C/Gez vili@helium"
]; ];
#################### Basic fail2ban configuration ####################
services.fail2ban = {
enable = true;
bantime = "1h";
bantime-increment = {
enable = true;
factor = "2";
formula = "ban.Time * (1 << (min(ban.Count, 6) * banFactor))";
maxtime = "90d";
};
jails = {
DEFAULT.settings = {
findtime = 3600;
};
};
};
#################### BASE #################### #################### BASE ####################
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.