bed41cfaf3
- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport), fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER), filter for the JSON access log, sshd hardening.conf, README with the order and the two traps measured in the episode - caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image - Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404, rate_limit zones on the vault token endpoint and the git login form - HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA
10 lines
475 B
Text
10 lines
475 B
Text
# /etc/ssh/sshd_config.d/hardening.conf (episode 10)
|
|
# Keys only. Password guessing is what the 130k login attempts in eight days were.
|
|
PasswordAuthentication no
|
|
KbdInteractiveAuthentication no
|
|
# Root stays reachable by key on this single-admin box. On a box with a real
|
|
# ops user, set this to "no" and log in as that user instead.
|
|
PermitRootLogin prohibit-password
|
|
#
|
|
# After editing: sshd -t && systemctl reload ssh
|
|
# TEST A SECOND SSH SESSION BEFORE YOU CLOSE THIS ONE.
|