nixos-config

commit 0989eb16642f9a95e706d568b4466db8c362363b
parent 86d9a9838db554ddc10a61645fda1a95ab05215d
Author: vin <vin@vineetk.net>
Date:   Sun,  2 Mar 2025 04:45:45 -0500

saklas: setup endlessh tarpit and fail2ban for ssh

Diffstat:
M
hosts/saklas/default.nix
 | 
20
+++++++++++++++++++-

1 file changed, 19 insertions(+), 1 deletion(-)
diff --git a/hosts/saklas/default.nix b/hosts/saklas/default.nix
@@ -144,9 +144,27 @@
       };
     };
 
-    # ssh
+    # SSH
+    # first use tarpit
+    endlessh = {
+      enable = true;
+      port = 22;
+      openFirewall = true;
+    };
+
+    # fail2ban if skiddie uses different port
+    fail2ban = {
+      enable = true;
+      ignoreIP = [
+        "35.142.66.239/20"
+        "45.134.142.0/24"
+      ];
+    };
+
+    # normal openssh
     openssh = {
       enable = true;
+      ports = [ 2222 ];
 
       settings = {
         KbdInteractiveAuthentication = false;