SOC/scripts/jail.local at main · 0xCyberLiTech/SOC · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
[DEFAULT]
ignoreip = 127.0.0.1/8 ::1 <LAN-CIDR>
bantime = 3600
findtime = 600
maxretry = 3
dbpurgeage = 2592000

[sshd]
enabled = true
port = <SSH-PORT>
logpath = /var/log/auth.log
maxretry = 3
action = nftables[name=sshd, port=<SSH-PORT>, protocol=tcp]
         crowdsec-sync[name=sshd]

[nginx-http-auth]
enabled = false
port = http,https
logpath = /var/log/nginx/error.log
maxretry = 5

[nginx-badbots]
enabled = false
port = http,https
logpath = /var/log/nginx/access.log
maxretry = 2

[nginx-cve]
enabled  = true
filter   = nginx-cve
logpath  = /var/log/nginx/access.log
maxretry = 1
bantime  = 86400
findtime = 3600
action = nftables[name=nginx-cve, port=http, protocol=tcp]
         crowdsec-sync[name=nginx-cve]