diff options
author | Peter Hoeg <peter@hoeg.com> | 2017-09-28 14:05:09 +0800 |
---|---|---|
committer | Peter Hoeg <peter@hoeg.com> | 2017-10-14 14:38:04 +0800 |
commit | 69d8b81b4ba613dbf59850b8f32e2d7ddeb133be (patch) | |
tree | ee75c904957517a11a36ef1874dde3e3a7c7db7f | |
parent | 35711638587a5079b1fcb6354a71d9b8203cd6e1 (diff) | |
download | nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar.gz nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar.bz2 nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar.lz nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar.xz nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.tar.zst nixlib-69d8b81b4ba613dbf59850b8f32e2d7ddeb133be.zip |
sshguard: make it run
-rw-r--r-- | nixos/modules/services/security/sshguard.nix | 70 |
1 files changed, 33 insertions, 37 deletions
diff --git a/nixos/modules/services/security/sshguard.nix b/nixos/modules/services/security/sshguard.nix index 5a183443f71d..c36ab405f9b0 100644 --- a/nixos/modules/services/security/sshguard.nix +++ b/nixos/modules/services/security/sshguard.nix @@ -87,54 +87,50 @@ in { config = mkIf cfg.enable { - environment.systemPackages = [ pkgs.sshguard pkgs.iptables pkgs.ipset ]; - - environment.etc."sshguard.conf".text = let + environment.etc."sshguard.conf".text = let list_services = ( name: "-t ${name} "); in '' - BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset" - LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl -afb -p info -n1 ${toString (map list_services cfg.services)} -o cat" + BACKEND="${lib.getBin pkgs.sshguard}/libexec/sshg-fw-ipset" + LOGREADER="LANG=C ${lib.getBin pkgs.systemd}/bin/journalctl -afb -p info -n1 ${toString (map list_services cfg.services)} -o cat" ''; - systemd.services.sshguard = - { description = "SSHGuard brute-force attacks protection system"; + systemd.services.sshguard = { + description = "SSHGuard brute-force attacks protection system"; - wantedBy = [ "multi-user.target" ]; - after = [ "network.target" ]; - partOf = optional config.networking.firewall.enable "firewall.service"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + partOf = optional config.networking.firewall.enable "firewall.service"; - path = [ pkgs.iptables pkgs.ipset pkgs.iproute pkgs.systemd ]; + path = with pkgs; [ iptables ipset iproute systemd ]; - postStart = '' - mkdir -p /var/lib/sshguard - ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet - ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6 - ${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP - ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP - ''; + postStart = '' + mkdir -p /var/lib/sshguard + ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet + ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6 + ${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP + ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP + ''; - preStop = '' - ${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP - ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP - ''; + preStop = '' + ${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP + ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP + ''; - unitConfig.Documentation = "man:sshguard(8)"; + unitConfig.Documentation = "man:sshguard(8)"; - serviceConfig = { - Type = "simple"; - ExecStart = let - list_whitelist = ( name: "-w ${name} "); - in '' - ${pkgs.sshguard}/bin/sshguard -a ${toString cfg.attack_threshold} ${optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file} "}-i /run/sshguard/sshguard.pid -p ${toString cfg.blocktime} -s ${toString cfg.detection_time} ${toString (map list_whitelist cfg.whitelist)} + serviceConfig = { + Type = "simple"; + ExecStart = let + list_whitelist = ( name: "-w ${name} "); + in '' + ${pkgs.sshguard}/bin/sshguard -a ${toString cfg.attack_threshold} ${optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file} "}-i /run/sshguard/sshguard.pid -p ${toString cfg.blocktime} -s ${toString cfg.detection_time} ${toString (map list_whitelist cfg.whitelist)} ''; - PIDFile = "/run/sshguard/sshguard.pid"; - Restart = "always"; - - ReadOnlyDirectories = "/"; - ReadWriteDirectories = "/run/sshguard /var/lib/sshguard"; - RuntimeDirectory = "sshguard"; - CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW"; - }; + Restart = "always"; + ProtectSystem = true; + PrivateTmp = true; + RuntimeDirectory = "sshguard"; + # CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW"; }; + }; }; } |