fixing fail2ban and set up ssh + tor on chungus

This commit is contained in:
Ingolf Wagner 2024-08-08 19:25:19 +02:00
parent cc5d655ef7
commit 26aaec9101
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
12 changed files with 52 additions and 27 deletions

View file

@ -11,7 +11,6 @@ with types;
imports = [ imports = [
#./avahi.nix #./avahi.nix
./fail2ban.nix
./hosts.nix ./hosts.nix
./nginx.nix ./nginx.nix
./sshd ./sshd

View file

@ -11,7 +11,6 @@ let
echo "${config.networking.hostName}" | boxes -d ansi -s 80x1 -a r > $out echo "${config.networking.hostName}" | boxes -d ansi -s 80x1 -a r > $out
''; '';
in in
{ {
@ -31,10 +30,6 @@ in
default = [ ]; default = [ ];
description = "keys to root login"; description = "keys to root login";
}; };
sshguard.enable = mkOption {
type = bool;
default = config.components.network.sshd.enable;
};
onlyTincAccess = mkOption { onlyTincAccess = mkOption {
type = bool; type = bool;
default = false; default = false;
@ -71,12 +66,6 @@ in
}) })
(mkIf cfg.sshguard.enable {
environment.systemPackages = [ pkgs.ipset ];
services.sshguard.enable = lib.mkDefault true;
#boot.kernelModules = ["xt_set"];
})
(mkIf (cfg.onlyTincAccess && cfg.enable) { (mkIf (cfg.onlyTincAccess && cfg.enable) {
networking.firewall.extraCommands = '' networking.firewall.extraCommands = ''
iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0 iptables --table nat --append PREROUTING ! --in-interface tinc.+ --protocol tcp --match tcp --dport 22 --jump REDIRECT --to-ports 0

View file

@ -9,9 +9,6 @@ let
(machine: (machine:
{ {
hostNames = [ hostNames = [
"[${machine}]:2222"
"[${machine}.${tld}]:2222"
"[${machine}.private]:2222"
"${machine}" "${machine}"
"${machine}.${tld}" "${machine}.${tld}"
"${machine}.private" "${machine}.private"
@ -19,6 +16,19 @@ let
publicKey = publicKey machine; publicKey = publicKey machine;
} }
); );
bootMachines = clanLib.readFactFromAllMachines "ssh.boot.id_ed25519.pub";
knownBootHosts = lib.mapAttrs'
(machine: publicKey: nameValuePair
"boot_${machine}"
{
inherit publicKey;
hostNames = [
"[${machine}]:2222"
"[${machine}.public]:2222"
];
}
)
bootMachines;
in in
{ {
@ -30,6 +40,6 @@ in
}; };
config = mkIf config.components.network.zerotier.enable { config = mkIf config.components.network.zerotier.enable {
services.openssh.knownHosts = knownHosts; services.openssh.knownHosts = knownHosts // knownBootHosts;
}; };
} }

View file

@ -21,6 +21,7 @@ with types;
# ssh host key # ssh host key
clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; }; clan.core.facts.services."boot.ssh" = factsGenerator.ssh { name = "boot"; };
# todo: maybe put this in a component
# boot # boot
boot.initrd.systemd.enable = true; boot.initrd.systemd.enable = true;
boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}"; boot.initrd.systemd.contents."/etc/hostname".text = "unlock.${config.networking.hostName}";

View file

@ -1,3 +1,6 @@
{ {
imports = [ ./boot ]; imports = [
./boot
./network
];
} }

View file

@ -0,0 +1,6 @@
{
imports = [
./fail2ban.nix
./sshguard.nix
];
}

View file

@ -1,14 +1,14 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
with lib; with lib;
{ {
options.components.network.fail2ban.enable = mkOption { options.features.network.fail2ban.enable = mkOption {
type = lib.types.bool; type = lib.types.bool;
default = false; default = false;
}; };
config = mkMerge [ config = mkMerge [
(mkIf config.components.network.fail2ban.enable { (mkIf config.features.network.fail2ban.enable {
environment.systemPackages = [ pkgs.fail2ban pkgs.ipset ]; environment.systemPackages = [ pkgs.fail2ban ];
services.fail2ban = { services.fail2ban = {
enable = true; enable = true;
#package = pkgs.legacy_2311.fail2ban; #package = pkgs.legacy_2311.fail2ban;
@ -19,7 +19,7 @@ with lib;
# custom defined jails # custom defined jails
# -------------------- # --------------------
# https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf # https://github.com/fail2ban/fail2ban/blob/master/config/jail.conf
(mkIf config.components.network.fail2ban.enable { (mkIf config.features.network.fail2ban.enable {
services.fail2ban.jails.nginx-git-not-found.settings = { services.fail2ban.jails.nginx-git-not-found.settings = {
port = "http,https"; port = "http,https";
logpath = "%(nginx_error_log)s"; logpath = "%(nginx_error_log)s";
@ -33,7 +33,7 @@ with lib;
''; '';
}; };
}) })
(mkIf config.components.network.fail2ban.enable { (mkIf config.features.network.fail2ban.enable {
services.fail2ban.jails.nginx-git-bad-request.settings = { services.fail2ban.jails.nginx-git-bad-request.settings = {
port = "http,https"; port = "http,https";
logpath = "%(nginx_error_log)s"; logpath = "%(nginx_error_log)s";

View file

@ -0,0 +1,18 @@
{ pkgs, config, lib, assets, ... }:
with lib;
with types;
{
options.features.network.sshguard = {
enable = mkOption {
type = bool;
default = false;
};
};
config = mkIf config.features.network.sshguard.enable {
environment.systemPackages = [ pkgs.ipset ];
services.sshguard.enable = true;
};
}

View file

@ -43,7 +43,6 @@
components.media.enable = true; components.media.enable = true;
components.media.tts-client.enable = false; components.media.tts-client.enable = false;
components.network.enable = true; components.network.enable = true;
components.network.sshd.sshguard.enable = false;
components.network.wifi.enable = true; components.network.wifi.enable = true;
components.terminal.enable = true; components.terminal.enable = true;

View file

@ -55,7 +55,9 @@
components.network.wifi.enable = false; components.network.wifi.enable = false;
components.terminal.enable = true; components.terminal.enable = true;
features.boot.ssh.enable = true;
features.boot.ssh.kernelModules = [ "e1000e" ]; features.boot.ssh.kernelModules = [ "e1000e" ];
features.boot.tor.enable = true;
components.monitor.enable = true; components.monitor.enable = true;
components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317"; components.monitor.opentelemetry.receiver.endpoint = "0.0.0.0:4317";
@ -68,7 +70,6 @@
networking.hostName = "chungus"; networking.hostName = "chungus";
hardware.graphics.enable = true; hardware.graphics.enable = true;
hardware.graphics.enable32Bit = true; hardware.graphics.enable32Bit = true;
hardware.graphics.extraPackages = with pkgs; [ hardware.graphics.extraPackages = with pkgs; [

View file

@ -7,6 +7,7 @@
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!) boot.tmp.useTmpfs = true; # make /tmp a tmpfs (performance!)
boot.supportedFilesystems = [ "zfs" ]; boot.supportedFilesystems = [ "zfs" ];

View file

@ -47,9 +47,7 @@
components.network.nginx.landingpage.enable = false; components.network.nginx.landingpage.enable = false;
components.network.wifi.enable = false; components.network.wifi.enable = false;
components.network.fail2ban.enable = true; features.network.fail2ban.enable = true;
components.network.sshd.sshguard.enable = false;
features.boot.ssh.enable = true; features.boot.ssh.enable = true;
components.monitor.enable = true; components.monitor.enable = true;