2023-10-04 18:49:12 +02:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
{
|
|
|
|
|
services.fail2ban = {
|
|
|
|
|
enable = true;
|
2023-10-23 11:57:01 +02:00
|
|
|
ignoreIP = [
|
|
|
|
|
"141.30.0.0/16"
|
|
|
|
|
"141.76.0.0/16"
|
|
|
|
|
];
|
2023-10-20 16:57:02 +02:00
|
|
|
bantime-increment = {
|
|
|
|
|
enable = true;
|
|
|
|
|
};
|
2023-10-04 18:49:12 +02:00
|
|
|
|
|
|
|
|
jails = {
|
|
|
|
|
tor = ''
|
|
|
|
|
enabled = true
|
|
|
|
|
bantime = 25h
|
|
|
|
|
action = iptables-allports[name=fail2banTOR, protocol=all]
|
|
|
|
|
'';
|
2023-10-19 14:24:11 +02:00
|
|
|
dovecot = ''
|
|
|
|
|
enabled = true
|
|
|
|
|
# aggressive mode to add blocking for aborted connections
|
|
|
|
|
filter = dovecot[mode=aggressive]
|
|
|
|
|
maxretry = 3
|
|
|
|
|
'';
|
|
|
|
|
postfix = ''
|
|
|
|
|
enabled = true
|
|
|
|
|
filter = postfix[mode=aggressive]
|
|
|
|
|
maxretry = 3
|
|
|
|
|
'';
|
2023-10-04 18:49:12 +02:00
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
environment.etc = {
|
|
|
|
|
# dummy filter
|
|
|
|
|
"fail2ban/filter.d/tor.conf".text = ''
|
|
|
|
|
[Definition]
|
|
|
|
|
failregex =
|
|
|
|
|
ignoreregex =
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
systemd.services."fail2ban-tor" = {
|
|
|
|
|
script = ''
|
|
|
|
|
${lib.getExe pkgs.curl} -fsSL "https://check.torproject.org/torbulkexitlist" | sed '/^#/d' | while read IP; do
|
|
|
|
|
${config.services.fail2ban.package}/bin/fail2ban-client set "tor" banip "$IP" > /dev/null
|
|
|
|
|
done
|
|
|
|
|
'';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
systemd.timers."fail2ban-tor" = {
|
|
|
|
|
wantedBy = [ "timers.target" ];
|
|
|
|
|
timerConfig = {
|
|
|
|
|
OnCalendar = "daily";
|
|
|
|
|
Persistent = true;
|
|
|
|
|
Unit = "fail2ban-tor.service";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
}
|
