Add fail2ban and firewall. #1

apoorv569 commented 2025年02月28日 20:58:59 +01:00

This PR adds fail2ban-service-type with a sshd jail setup and iptables-service-type with some basic rules which blocks all incoming traffic by default and only allow certain things like ssh on port 2222, HTTP on 80 and HTTPS 443.

This also adds a couple more options to openssh-service-type to disable root-login and password-authentication, so you can only login via a valid ssh key.

This PR adds `fail2ban-service-type` with a `sshd` jail setup and `iptables-service-type` with some basic rules which blocks all incoming traffic by default and only allow certain things like `ssh` on port `2222`, `HTTP` on `80` and `HTTPS` `443`. This also adds a couple more options to `openssh-service-type` to disable `root-login` and `password-authentication`, so you can only login via a valid `ssh` key.

daviwil commented 2025年03月01日 05:24:35 +01:00

Thanks a lot for putting this together! I'll merge and deploy it now so that we can minimize some of the spam on the server.

Thanks a lot for putting this together! I'll merge and deploy it now so that we can minimize some of the spam on the server.

apoorv569 commented 2025年03月01日 23:12:57 +01:00

@daviwil wrote in #1 (comment):

Thanks a lot for putting this together! I'll merge and deploy it now so that we can minimize some of the spam on the server.

No problem. Let me know if you face some issue with the changes. Also don't forget to copy your ssh key before you apply these changes otherwise you will be locked out, as these changes disable password authentication.

@daviwil wrote in https://codeberg.org/SystemCrafters/server-configurations/pulls/1#issuecomment-2887063: > Thanks a lot for putting this together! I'll merge and deploy it now so that we can minimize some of the spam on the server. No problem. Let me know if you face some issue with the changes. Also don't forget to copy your `ssh` key before you apply these changes otherwise you will be locked out, as these changes disable password authentication.