From 544da1ba50d9cbf51a18ca0abf1db66b3baa7460 Mon Sep 17 00:00:00 2001
From: Andrew Opalach <andrew@akon.city>
Date: Fri, 17 Oct 2025 12:22:00 -0400
Subject: Gentoo desktop

---
 hosts/station/fail2ban/fail2ban.d/station.local |  2 ++
 hosts/station/fail2ban/jail.d/station.local     | 39 +++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 hosts/station/fail2ban/fail2ban.d/station.local
 create mode 100644 hosts/station/fail2ban/jail.d/station.local

(limited to 'hosts/station/fail2ban')

diff --git a/hosts/station/fail2ban/fail2ban.d/station.local b/hosts/station/fail2ban/fail2ban.d/station.local
new file mode 100644
index 0000000..b3d98c4
--- /dev/null
+++ b/hosts/station/fail2ban/fail2ban.d/station.local
@@ -0,0 +1,2 @@
+[DEFAULT]
+allowipv6 = true
diff --git a/hosts/station/fail2ban/jail.d/station.local b/hosts/station/fail2ban/jail.d/station.local
new file mode 100644
index 0000000..2110612
--- /dev/null
+++ b/hosts/station/fail2ban/jail.d/station.local
@@ -0,0 +1,39 @@
+[DEFAULT]
+maxretry = 4
+findtime = 60m
+bantime = 24h
+backend = systemd
+logtarget = SYSTEMD-JOURNAL
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+#mta = sendmail
+#destemail = mark@akon.city
+#action = %(action_)s
+#  %(mta)s-whois-matches[sender="%(sender)s", dest="%(destemail)s", chain="%(chain)s"] 
+
+[postfix]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=postfix.service
+
+[sieve]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[dovecot]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[dovecot-pop3imap]
+enabled = true
+filter = dovecot-pop3imap
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[nginx-limit-req]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=nginx.service
+
+[sshd]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=ssh.service
-- 
cgit v1.2.3-101-g0448