# Cron
logcheck_minute: 47

cron_worker:
  - { dst: "/usr/local/sbin/backup_daily",
        own: "root", grp: "root", mode: "0755", src: "server2/backup_daily" }

cron_secret:
  - { dst: "/usr/local/etc/backup_secret",
        own: "root", grp: "root", mode: "0600", src: "secret/backup_secret.j2" }

# Fail2ban
enabled_jails:
  - recidive
  - sshd
  - apache

# ModSecurity2
#modsec_ruleengine: "DetectionOnly"
modsec_ruleengine: "On"

# Network range
nft_lan_ip4: "192.168.110.0/24"
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"

# Allow from lan 
nft_lan_allow_elements:
  - { proto_port: "tcp . 22",			comment: "SSH" }
  - { proto_port: "udp . 33434-33534",		comment: "traceroute" }
  - { proto_port: "tcp . 10050",		comment: "ZABBIX agent" }
  - { proto_port: "udp . 10050",		comment: "ZABBIX agent" }

# Deny this server(input)
nft_input_silent_elements:
  - { proto_port: "udp . 67",			comment: "DHCP Request" }
  - { proto_port: "udp . 68",			comment: "DHCP Answer" }
  - { proto_port: "udp . 137",			comment: "NetBIOS Name Service(WINS)" }
  - { proto_port: "udp . 138",			comment: "NetBIOS Datagram Service" }

# Deny this server(invalid)
nft_invalid_silent_elements:
  - { proto_port: "tcp . 0-65535 . 443",	comment: "HTTPS" }
  - { proto_port: "tcp . 0-65535 . 445",	comment: "SMB over TCP" }
  - { proto_port: "tcp . 0-65535 . 49152-49200",comment: "RPC The same value as SMB_RPC_PORTS." }