67 lines
961 B
Django/Jinja
67 lines
961 B
Django/Jinja
# Ansible managed
|
|
[DEFAULT]
|
|
banaction = nftables-multiport
|
|
banaction_allports = nftables-allports
|
|
|
|
{% if 'recidive' in enabled_jails %}
|
|
#
|
|
# 再犯への対策(bantime変更時はdbpurgeageも修正のこと)
|
|
#
|
|
[recidive]
|
|
enabled = true
|
|
findtime = 7d
|
|
maxretry = 3
|
|
bantime = 7d
|
|
|
|
{% endif -%}
|
|
|
|
{% if 'sshd' in enabled_jails %}
|
|
#
|
|
# OpenSSH
|
|
#
|
|
[sshd]
|
|
enabled = true
|
|
mode = aggressive
|
|
findtime = 10m
|
|
maxretry = 2
|
|
bantime = 10m
|
|
|
|
{% endif -%}
|
|
|
|
{% if 'apache' in enabled_jails %}
|
|
#
|
|
# Apache2
|
|
#
|
|
[apache-auth]
|
|
enabled = true
|
|
backend = pyinotify
|
|
|
|
[apache-modsecurity]
|
|
enabled = true
|
|
backend = pyinotify
|
|
|
|
[apache-404]
|
|
enabled = true
|
|
port = http,https
|
|
backend = pyinotify
|
|
logpath = %(apache_access_log)s
|
|
|
|
[apache-410]
|
|
enabled = true
|
|
port = http,https
|
|
backend = pyinotify
|
|
logpath = /var/log/apache2/defence-access.log
|
|
|
|
{% endif -%}
|
|
|
|
{% if 'postfix' in enabled_jails %}
|
|
#
|
|
# Postfix
|
|
#
|
|
[postfix]
|
|
enabled = true
|
|
mode = aggressive
|
|
findtime = 60m
|
|
|
|
{% endif -%}
|