45 lines
1.4 KiB
YAML
45 lines
1.4 KiB
YAML
# Cron
|
|
logcheck_minute: 47
|
|
|
|
cron_worker:
|
|
- { dst: "/usr/local/sbin/backup_daily",
|
|
own: "root", grp: "root", mode: "0755", src: "server2/backup_daily" }
|
|
|
|
cron_secret:
|
|
- { dst: "/usr/local/etc/backup_secret",
|
|
own: "root", grp: "root", mode: "0600", src: "secret/backup_secret.j2" }
|
|
|
|
# Fail2ban
|
|
enabled_jails:
|
|
- recidive
|
|
- sshd
|
|
- apache
|
|
|
|
# ModSecurity2
|
|
#modsec_ruleengine: "DetectionOnly"
|
|
modsec_ruleengine: "On"
|
|
|
|
# Network range
|
|
nft_lan_ip4: "192.168.110.0/24"
|
|
nft_lan_ip6: "fdaa:aaaa:aaaa:aaaa::/64"
|
|
|
|
# Allow from lan
|
|
nft_lan_allow_elements:
|
|
- { proto_port: "tcp . 22", comment: "SSH" }
|
|
- { proto_port: "udp . 33434-33534", comment: "traceroute" }
|
|
- { proto_port: "tcp . 10050", comment: "ZABBIX agent" }
|
|
- { proto_port: "udp . 10050", comment: "ZABBIX agent" }
|
|
|
|
# Deny this server(input)
|
|
nft_input_silent_elements:
|
|
- { proto_port: "udp . 67", comment: "DHCP Request" }
|
|
- { proto_port: "udp . 68", comment: "DHCP Answer" }
|
|
- { proto_port: "udp . 137", comment: "NetBIOS Name Service(WINS)" }
|
|
- { proto_port: "udp . 138", comment: "NetBIOS Datagram Service" }
|
|
|
|
# Deny this server(invalid)
|
|
nft_invalid_silent_elements:
|
|
- { proto_port: "tcp . 0-65535 . 443", comment: "HTTPS" }
|
|
- { proto_port: "tcp . 0-65535 . 445", comment: "SMB over TCP" }
|
|
- { proto_port: "tcp . 0-65535 . 49152-49200",comment: "RPC The same value as SMB_RPC_PORTS." }
|