49 lines
1.4 KiB
YAML
49 lines
1.4 KiB
YAML
# Cron
|
|
logcheck_minute: 46
|
|
|
|
cron_worker:
|
|
- { dst: "/usr/local/sbin/backup_daily",
|
|
own: "root", grp: "root", mode: "0755", src: "server1/backup_daily" }
|
|
|
|
cron_secret:
|
|
- { dst: "/usr/local/etc/backup_secret",
|
|
own: "root", grp: "root", mode: "0600", src: "secret/backup_secret.j2" }
|
|
|
|
cron_prvkey:
|
|
- { dst: "/etc/ssl/private/other.key",
|
|
own: "root", grp: "root", mode: "0600", cnt: "{{ vault_ssh_private_key }}" }
|
|
|
|
# Fail2ban
|
|
enabled_jails:
|
|
- recidive
|
|
- sshd
|
|
- apache
|
|
- postfix
|
|
|
|
# ModSecurity2
|
|
#modsec_ruleengine: "DetectionOnly"
|
|
modsec_ruleengine: "On"
|
|
|
|
# Network range
|
|
nft_lan_ip4: "192.168.110.0/24"
|
|
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"
|
|
|
|
# Allow from lan
|
|
nft_lan_allow_elements:
|
|
- { proto_port: "tcp . 22", comment: "SSH" }
|
|
- { proto_port: "tcp . 143", comment: "IMAP" }
|
|
- { proto_port: "tcp . 465", comment: "SMTP Auth" }
|
|
- { proto_port: "tcp . 587", comment: "Submission" }
|
|
- { proto_port: "udp . 33434-33534", comment: "traceroute" }
|
|
|
|
# Deny this server(input)
|
|
nft_input_silent_elements:
|
|
- { proto_port: "udp . 67", comment: "DHCP Request" }
|
|
- { proto_port: "udp . 68", comment: "DHCP Answer" }
|
|
- { proto_port: "udp . 137", comment: "NetBIOS Name Service(WINS)" }
|
|
- { proto_port: "udp . 138", comment: "NetBIOS Datagram Service" }
|
|
|
|
# Deny this server(invalid)
|
|
nft_invalid_silent_elements:
|
|
- { proto_port: "tcp . 0-65535 . 443", comment: "HTTPS" }
|