Fail2ban configuration

Fail2ban_configuration.md

Fail2ban configuration

• Jail.local
• Nextcloud filter
• Jellyfin filter

jail.local

[INCLUDES]

before = paths-debian.conf


[DEFAULT]

ignoreip = 127.0.0.1/8
bantime = 604800 # 1 Week
findtime = 3600 # 1 hour
maxretry = 2
backend = auto
usedns = warn
logencoding = auto
filter = %(__name__)s
protocol = tcp
chain = INPUT
port = 0:65535
banaction = iptables-multiport
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action = %(action_)s
enabled = false


[sshd]

enabled = true
port = ssh
logpath = %(sshd_log)s


[sshd-ddos]

enabled = true
port = ssh
logpath = %(sshd_log)s


[nginx-botsearch]

enabled = true
port     = http,https
logpath  = %(nginx_error_log)s


[nextcloud]

enabled = true
port = http,https
maxretry = 3
filter = nextcloud
logpath = /var/snap/nextcloud/common/nextcloud/data/nextcloud.log


[jellyfin]

enabled = true
port = http,https
maxretry = 3
filter = jellyfin
logpath = %(nginx_access_log)s

jellyfin.conf

[INCLUDES]

before = common.conf

[Definition]

_daemon = jellyfin

failregex = ^<HOST> \- \S+ \[.*\] \"POST /emby/Users/authenticatebyname HTTP.*\" 401 .+$

datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
              ^[^\[]*\[({DATE})
              {^LN-BEG}

ignoreregex =

nextcloud.conf

[INCLUDES]

before = common.conf

[Definition]

_daemon = nextcloud

failregex=^{"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}$
 ^{"reqId":".*","level":2,"time":".*","remoteAddr":".*","app":"core".*","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)".*}$

ignoreregex =