bed41cfaf3
- hardening/: ufw after.rules block for DOCKER-USER (ctorigdstport, not dport), fail2ban jail.local with sshd (systemd backend) and caddy-probes (chain DOCKER-USER), filter for the JSON access log, sshd hardening.conf, README with the order and the two traps measured in the episode - caddy/Dockerfile: xcaddy build with caddy-ratelimit, compose builds the image - Caddyfile: common snippet (JSON access log, Server header stripped), vault /admin 404, rate_limit zones on the vault token endpoint and the git login form - HARDENING.md: firewall and fail2ban sections rewritten around what the port scan saw Claude-Session: https://claude.ai/code/session_017iP581CYtPfxdZYPPAyWZA
33 lines
1.1 KiB
Text
33 lines
1.1 KiB
Text
# /etc/fail2ban/jail.local (episode 10)
|
|
[DEFAULT]
|
|
bantime = 1h
|
|
findtime = 10m
|
|
maxretry = 5
|
|
# localhost and the NetBird mesh range are never banned. Do NOT put your own
|
|
# home/office IP here - if you never guess passwords you never get banned, and
|
|
# an ignore entry is one more secret to keep out of a public repo.
|
|
ignoreip = 127.0.0.1/8 ::1 100.125.0.0/16
|
|
banaction = iptables-multiport
|
|
|
|
[sshd]
|
|
enabled = true
|
|
# Debian 13 ships no /var/log/auth.log without rsyslog; read the journal instead.
|
|
backend = systemd
|
|
maxretry = 5
|
|
findtime = 10m
|
|
bantime = 1h
|
|
|
|
[caddy-probes]
|
|
enabled = true
|
|
backend = auto
|
|
logpath = /opt/selfhostedops-stack/logs/caddy/access.log
|
|
filter = caddy-probes
|
|
maxretry = 10
|
|
findtime = 1m
|
|
bantime = 1h
|
|
port = http,https
|
|
# The ban has to land in DOCKER-USER, not INPUT - Caddy's traffic is forwarded,
|
|
# a ban in INPUT never touches it and the "banned" bot keeps getting answers.
|
|
# chain must be a plain parameter here: the default action_ template passes
|
|
# chain="%(chain)s", so putting [chain=...] inside banaction gets overridden.
|
|
chain = DOCKER-USER
|