# Ansible managed
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports

{% if 'recidive' in enabled_jails %}
#
# 再犯への対策(bantime変更時はdbpurgeageも修正のこと)
#
[recidive]
enabled  = true
findtime = 7d
maxretry = 3
bantime  = 7d

{% endif -%}

{% if 'sshd' in enabled_jails %}
#
# OpenSSH
#
[sshd]
enabled  = true
mode     = aggressive
findtime = 10m
maxretry = 2
bantime  = 10m

{% endif -%}

{% if 'apache' in enabled_jails %}
#
# Apache2
#
[apache-auth]
enabled = true
backend = pyinotify

[apache-modsecurity]
enabled = true
backend = pyinotify

[apache-404]
enabled  = true
port     = http,https
backend  = pyinotify
logpath  = %(apache_access_log)s

[apache-410]
enabled  = true
port     = http,https
backend  = pyinotify
logpath  = /var/log/apache2/defence-access.log

{% endif -%}

{% if 'postfix' in enabled_jails %}
#
# Postfix
#
[postfix]
enabled = true
mode = aggressive
findtime = 60m

{% endif -%}