6ea457d01d
- Nginx configs with security headers (X-Frame-Options, CSP, etc.) - fail2ban jails for nginx (botsearch, bad-request, forbidden) - Kernel hardening via sysctl (rp_filter, no redirects, log martians) - SSH hardening (no root, max 3 attempts, no X11) - UFW rules export - Idempotent setup.sh to restore all configs on fresh install - Flask bound to 127.0.0.1 (nginx-only access) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
717 B
Plaintext
46 lines
717 B
Plaintext
[DEFAULT]
|
|
bantime = 3600
|
|
maxretry = 3
|
|
findtime = 600
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
bantime = 3600
|
|
backend = systemd
|
|
|
|
[samba]
|
|
enabled = true
|
|
port = 139,445
|
|
filter = samba
|
|
logpath = /var/log/samba/log.smbd
|
|
maxretry = 5
|
|
bantime = 3600
|
|
|
|
[nginx-botsearch]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-botsearch
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
|
|
[nginx-bad-request]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-bad-request
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
|
|
[nginx-forbidden]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-forbidden
|
|
logpath = /var/log/nginx/error.log
|
|
maxretry = 5
|
|
bantime = 3600
|