From 605a588ea6d952227fe6554011add1650bfe8eb7 Mon Sep 17 00:00:00 2001 From: Solene Rapenne Date: Sun, 2 Oct 2022 12:59:54 +0200 Subject: [PATCH] nixos/fail2ban: improve module documentation --- nixos/modules/services/security/fail2ban.nix | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/security/fail2ban.nix b/nixos/modules/services/security/fail2ban.nix index 29aa49c8aada..e208eed008ae 100644 --- a/nixos/modules/services/security/fail2ban.nix +++ b/nixos/modules/services/security/fail2ban.nix @@ -91,8 +91,9 @@ in example = "nftables-multiport"; description = lib.mdDoc '' Default banning action (e.g. iptables, iptables-new, iptables-multiport, - shorewall, etc) It is used to define action_* variables. Can be overridden - globally or per section within jail.local file + iptables-ipset-proto6-allports, shorewall, etc) It is used to + define action_* variables. Can be overridden globally or per + section within jail.local file ''; }; @@ -212,10 +213,18 @@ in filter = apache-nohome action = iptables-multiport[name=HTTP, port="http,https"] logpath = /var/log/httpd/error_log* + backend = auto findtime = 600 bantime = 600 maxretry = 5 '''; + dovecot = ''' + # block IPs which failed to log-in + # aggressive mode add blocking for aborted connections + enabled = true + filter = dovecot[mode=aggressive] + maxretry = 3 + '''; } ''; type = types.attrsOf types.lines;