NixOS/system/modules/openssh.nix

41 lines
1.1 KiB
Nix
Raw Normal View History

2024-06-12 18:09:56 +07:00
{ config, lib, ... }:
let
cfg = config.profile.openssh;
in
{
config = lib.mkIf cfg.enable {
2024-06-12 20:25:30 +07:00
networking.firewall = {
allowedTCPPorts = lib.mkAfter [ 22 ];
};
2024-06-12 18:09:56 +07:00
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
2024-06-12 18:09:56 +07:00
UseDns = true;
X11Forwarding = false;
PermitRootLogin = "no";
};
};
2024-06-12 19:53:29 +07:00
services.fail2ban = {
enable = true;
# Ban IP after 5 failures
maxretry = 5;
ignoreIP = [
# Whitelist some subnets
"10.0.0.0/8"
"172.16.0.0/12"
"192.168.0.0/16"
];
bantime = "24h"; # Ban IPs for one day on the first ban
bantime-increment = {
enable = true; # Enable increment of bantime after each violation
2024-06-25 22:45:00 +07:00
# formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
multipliers = "1 2 4 8 16 32 64";
2024-06-12 19:53:29 +07:00
maxtime = "168h"; # Do not ban for more than 1 week
overalljails = true; # Calculate the bantime based on all the violations
};
};
2024-06-12 18:09:56 +07:00
};
}