TheWanderingCrow/CrOS
1
0
Fork 0
mirror of https://github.com/TheWanderingCrow/CrOS.git synced 2026-01-10 17:34:05 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

apply fail2ban to nginx

Browse source
This commit is contained in:
TheWanderingCrow 2025-08-20 09:13:41 -04:00
parent 068c3c9dff
commit 6ad937e428
1 changed files with 26 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

27
modules/services/fail2ban/default.nix
View file

@ -1,5 +1,30 @@
{
{pkgs, ...}: {
environment.etc = {
# Define an action that will trigger a Ntfy push notification upon the issue of every new ban
"fail2ban/action.d/ntfy.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
norestored = true # Needed to avoid receiving a new notification after every restart
actionban = curl -H "Title: <ip> has been banned" -d "<name> jail has banned <ip> from accessing $(hostname) after <failures> attempts of hacking the system." https://ntfy.sh/Fail2banNotifications
'');
# Defines a filter that detects URL probing by reading the Nginx access log
"fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
'');
};
services.fail2ban = {
enable = true;
jails = {
nginx-url-probe.settings = {
enabled = true;
filter = "nginx-url-probe";
logpath = "/var/log/nginx/access.log";
action = '' %(action_)s[blocktype=DROP]
ntfy'';
backend = "auto"; # Do not forget to specify this if your jail uses a log file
maxretry = 5;
findtime = 600;
};
};
};
}