2 files changed, 41 insertions, 0 deletions
diff --git a/hosts/station/fail2ban/fail2ban.d/station.local b/hosts/station/fail2ban/fail2ban.d/station.local
new file mode 100644
index 0000000..b3d98c4
--- /dev/null
+++ b/hosts/station/fail2ban/fail2ban.d/station.local
@@ -0,0 +1,2 @@
+[DEFAULT]
+allowipv6 = true
diff --git a/hosts/station/fail2ban/jail.d/station.local b/hosts/station/fail2ban/jail.d/station.local
new file mode 100644
index 0000000..2110612
--- /dev/null
+++ b/hosts/station/fail2ban/jail.d/station.local
@@ -0,0 +1,39 @@
+[DEFAULT]
+maxretry = 4
+findtime = 60m
+bantime = 24h
+backend = systemd
+logtarget = SYSTEMD-JOURNAL
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+#mta = sendmail
+#destemail = mark@akon.city
+#action = %(action_)s
+#  %(mta)s-whois-matches[sender="%(sender)s", dest="%(destemail)s", chain="%(chain)s"] 
+
+[postfix]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=postfix.service
+
+[sieve]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[dovecot]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[dovecot-pop3imap]
+enabled = true
+filter = dovecot-pop3imap
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[nginx-limit-req]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=nginx.service
+
+[sshd]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=ssh.service