commit eb90705d456d1bdd64f8e35f07e4acc34d153f5d · pyrox.dev/nixpkgs

+14 -14
nixos/modules/services/security/fail2ban.nix
···

       50
       50
        
       

     

       51
       51
        
             jails = mkOption {

     

       52
       52
        
               default = { };

     

       53
       53
       -
               example =

     

       54
       54
       -
                 { "apache-nohome-iptables" =

     

       55
       55
       -
                     ''

     

       56
       56
       -
                       # Block an IP address if it accesses a non-existent

     

       57
       57
       -
                       # home directory more than 5 times in 10 minutes,

     

       58
       58
       -
                       # since that indicates that it's scanning.

     

       59
       59
       -
                       filter   = apache-nohome

     

       60
       60
       -
                       action   = iptables-multiport[name=HTTP, port="http,https"]

     

       61
       61
       -
                       logpath  = /var/log/httpd/error_log*

     

       62
       62
       -
                       findtime = 600

     

       63
       63
       -
                       bantime  = 600

     

       64
       64
       -
                       maxretry = 5

     

       65
       65
       -
                     '';

     

       66
       66
       -
                 };

     

       53
       53
       +
               example = literalExample ''

     

       54
       54
       +
                 { apache-nohome-iptables = '''

     

       55
       55
       +
                     # Block an IP address if it accesses a non-existent

     

       56
       56
       +
                     # home directory more than 5 times in 10 minutes,

     

       57
       57
       +
                     # since that indicates that it's scanning.

     

       58
       58
       +
                     filter   = apache-nohome

     

       59
       59
       +
                     action   = iptables-multiport[name=HTTP, port="http,https"]

     

       60
       60
       +
                     logpath  = /var/log/httpd/error_log*

     

       61
       61
       +
                     findtime = 600

     

       62
       62
       +
                     bantime  = 600

     

       63
       63
       +
                     maxretry = 5

     

       64
       64
       +
                   ''';

     

       65
       65
       +
                 }

     

       66
       66
       +
               '';

     

       67
       67
        
               type = types.attrsOf types.lines;

     

       68
       68
        
               description =

     

       69
       69
        
                 ''