···

       
47
       
47
       
 
       
      maxtime = "168h"; # Do not ban for more than 1 week

     

       
48
       
48
       
 
       
      overalljails = true; # Calculate the bantime based on all the violations

     

       
49
       
49
       
 
       
    };

     

       
50
       
50
       
-
       
    jails = {

     

       
51
       
51
       
-
       
      apache-nohome-iptables.settings = {

     

       
52
       
52
       
-
       
        # Block an IP address if it accesses a non-existent

     

       
53
       
53
       
-
       
        # home directory more than 5 times in 10 minutes,

     

       
54
       
54
       
-
       
        # since that indicates that it's scanning.

     

       
55
       
55
       
-
       
        filter = "apache-nohome";

     

       
56
       
56
       
-
       
        action = ''iptables-multiport[name=HTTP, port="http,https"]'';

     

       
57
       
57
       
-
       
        logpath = "/var/log/httpd/error_log*";

     

       
58
       
58
       
-
       
        backend = "auto";

     

       
59
       
59
       
-
       
        findtime = 600;

     

       
60
       
60
       
-
       
        bantime  = 600;

     

       
61
       
61
       
-
       
        maxretry = 5;

     

       
62
       
62
       
-
       
      };

     

       
63
       
63
       
-
       
    };

     

       
64
       
50
       
 
       
  };

     

       
65
       
51
       
 
       


     

       
66
       
52
       
 
       
  virtualisation.docker = {

     

···

       
80
       
80
       
 
       
      maxtime = "168h"; # Do not ban for more than 1 week

     

       
81
       
81
       
 
       
      overalljails = true; # Calculate the bantime based on all the violations

     

       
82
       
82
       
 
       
    };

     

       
83
       
83
       
-
       
    jails = {

     

       
84
       
84
       
-
       
      apache-nohome-iptables.settings = {

     

       
85
       
85
       
-
       
        # Block an IP address if it accesses a non-existent

     

       
86
       
86
       
-
       
        # home directory more than 5 times in 10 minutes,

     

       
87
       
87
       
-
       
        # since that indicates that it's scanning.

     

       
88
       
88
       
-
       
        filter = "apache-nohome";

     

       
89
       
89
       
-
       
        action = ''iptables-multiport[name=HTTP, port="http,https"]'';

     

       
90
       
90
       
-
       
        logpath = "/var/log/httpd/error_log*";

     

       
91
       
91
       
-
       
        backend = "auto";

     

       
92
       
92
       
-
       
        findtime = 600;

     

       
93
       
93
       
-
       
        bantime  = 600;

     

       
94
       
94
       
-
       
        maxretry = 5;

     

       
95
       
95
       
-
       
      };

     

       
96
       
96
       
-
       
    };

     

       
97
       
83
       
 
       
  };

     

       
98
       
84
       
 
       


     

       
99
       
85
       
 
       
  # Static IP configuration via systemd-networkd

     

···

       
276
       
276
       
 
       
      maxtime = "168h"; # Do not ban for more than 1 week

     

       
277
       
277
       
 
       
      overalljails = true; # Calculate the bantime based on all the violations

     

       
278
       
278
       
 
       
    };

     

       
279
       
279
       
-
       
    jails = {

     

       
280
       
280
       
-
       
      apache-nohome-iptables.settings = {

     

       
281
       
281
       
-
       
        # Block an IP address if it accesses a non-existent

     

       
282
       
282
       
-
       
        # home directory more than 5 times in 10 minutes,

     

       
283
       
283
       
-
       
        # since that indicates that it's scanning.

     

       
284
       
284
       
-
       
        filter = "apache-nohome";

     

       
285
       
285
       
-
       
        action = ''iptables-multiport[name=HTTP, port="http,https"]'';

     

       
286
       
286
       
-
       
        logpath = "/var/log/httpd/error_log*";

     

       
287
       
287
       
-
       
        backend = "auto";

     

       
288
       
288
       
-
       
        findtime = 600;

     

       
289
       
289
       
-
       
        bantime  = 600;

     

       
290
       
290
       
-
       
        maxretry = 5;

     

       
291
       
291
       
-
       
      };

     

       
292
       
292
       
-
       
    };

     

       
293
       
279
       
 
       
  };

     

       
294
       
280
       
 
       


     

       
295
       
281
       
 
       
  # =============================================================================