public
/
nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Revert "sshguard: make it run" 

This reverts commit 69d8b81b4b.
This commit is contained in:
Peter Hoeg 2017-10-14 14:41:48 +08:00
parent 2b5aab4b0f
commit 3211098632
1 changed files with 36 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
nixos/modules/services/security/sshguard.nix
View File

@ -87,50 +87,54 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.sshguard pkgs.iptables pkgs.ipset ];
environment.etc."sshguard.conf".text = let environment.etc."sshguard.conf".text = let
list_services = ( name: "-t ${name} "); list_services = ( name: "-t ${name} ");
in '' in ''
BACKEND="${lib.getBin pkgs.sshguard}/libexec/sshg-fw-ipset" BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset"
LOGREADER="LANG=C ${lib.getBin pkgs.systemd}/bin/journalctl -afb -p info -n1 ${toString (map list_services cfg.services)} -o cat" LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl -afb -p info -n1 ${toString (map list_services cfg.services)} -o cat"
''; '';
systemd.services.sshguard = { systemd.services.sshguard =
description = "SSHGuard brute-force attacks protection system"; { description = "SSHGuard brute-force attacks protection system";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ "network.target" ]; after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service"; partOf = optional config.networking.firewall.enable "firewall.service";
path = with pkgs; [ iptables ipset iproute systemd ]; path = [ pkgs.iptables pkgs.ipset pkgs.iproute pkgs.systemd ];
postStart = '' postStart = ''
mkdir -p /var/lib/sshguard mkdir -p /var/lib/sshguard
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6 ${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6
${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP ${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP ${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
''; '';
preStop = '' preStop = ''
${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP ${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP ${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
''; '';
unitConfig.Documentation = "man:sshguard(8)"; unitConfig.Documentation = "man:sshguard(8)";
serviceConfig = { serviceConfig = {
Type = "simple"; Type = "simple";
ExecStart = let ExecStart = let
list_whitelist = ( name: "-w ${name} "); list_whitelist = ( name: "-w ${name} ");
in '' in ''
${pkgs.sshguard}/bin/sshguard -a ${toString cfg.attack_threshold} ${optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file} "}-i /run/sshguard/sshguard.pid -p ${toString cfg.blocktime} -s ${toString cfg.detection_time} ${toString (map list_whitelist cfg.whitelist)} ${pkgs.sshguard}/bin/sshguard -a ${toString cfg.attack_threshold} ${optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file} "}-i /run/sshguard/sshguard.pid -p ${toString cfg.blocktime} -s ${toString cfg.detection_time} ${toString (map list_whitelist cfg.whitelist)}
''; '';
Restart = "always"; PIDFile = "/run/sshguard/sshguard.pid";
ProtectSystem = true; Restart = "always";
PrivateTmp = true;
RuntimeDirectory = "sshguard"; ReadOnlyDirectories = "/";
# CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW"; ReadWriteDirectories = "/run/sshguard /var/lib/sshguard";
RuntimeDirectory = "sshguard";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
};
}; };
};
}; };
} }