summaryrefslogtreecommitdiff
path: root/data
diff options
context:
space:
mode:
authorViacheslav Hletenko <v.gletenko@vyos.io>2022-05-10 15:14:19 +0000
committerViacheslav Hletenko <v.gletenko@vyos.io>2022-05-12 17:27:38 +0000
commit2e81f9e057f598a9a9e5c2d617e3d0818005d850 (patch)
tree71081daf520515702ec608a66cd8831cd6cf88fb /data
parent432fd1b5e7b5a1e5b8503bf0dcd106369e323dc7 (diff)
downloadvyos-1x-2e81f9e057f598a9a9e5c2d617e3d0818005d850.tar.gz
vyos-1x-2e81f9e057f598a9a9e5c2d617e3d0818005d850.zip
sshguard: T4408: Add service ssh dynamic-protection
Sshguard protects hosts from brute-force attacks Can inspect logs and block "bad" addresses by threshold Auto-generate rules for nftables When service stopped all generated rules are deleted nft "type filter hook input priority filter - 10" set service ssh dynamic-protection set service ssh dynamic-protection block-time 120 set service ssh dynamic-protection detect-time 1800 set service ssh dynamic-protection threshold 30 set service ssh dynamic-protection whitelist-address 192.0.2.1
Diffstat (limited to 'data')
-rw-r--r--data/templates/ssh/sshguard_config.j227
-rw-r--r--data/templates/ssh/sshguard_whitelist.j27
2 files changed, 34 insertions, 0 deletions
diff --git a/data/templates/ssh/sshguard_config.j2 b/data/templates/ssh/sshguard_config.j2
new file mode 100644
index 000000000..58c6ad48d
--- /dev/null
+++ b/data/templates/ssh/sshguard_config.j2
@@ -0,0 +1,27 @@
+### Autogenerated by ssh.py ###
+
+{% if dynamic_protection is vyos_defined %}
+# Full path to backend executable (required, no default)
+BACKEND="/usr/libexec/sshguard/sshg-fw-nft-sets"
+
+# Shell command that provides logs on standard output. (optional, no default)
+# Example 1: ssh and sendmail from systemd journal:
+LOGREADER="LANG=C journalctl -afb -p info -n1 -t sshd -o cat"
+
+#### OPTIONS ####
+# Block attackers when their cumulative attack score exceeds THRESHOLD.
+# Most attacks have a score of 10. (optional, default 30)
+THRESHOLD={{ dynamic_protection.threshold }}
+
+# Block attackers for initially BLOCK_TIME seconds after exceeding THRESHOLD.
+# Subsequent blocks increase by a factor of 1.5. (optional, default 120)
+BLOCK_TIME={{ dynamic_protection.block_time }}
+
+# Remember potential attackers for up to DETECTION_TIME seconds before
+# resetting their score. (optional, default 1800)
+DETECTION_TIME={{ dynamic_protection.detect_time }}
+
+# IP addresses listed in the WHITELIST_FILE are considered to be
+# friendlies and will never be blocked.
+WHITELIST_FILE=/etc/sshguard/whitelist
+{% endif %}
diff --git a/data/templates/ssh/sshguard_whitelist.j2 b/data/templates/ssh/sshguard_whitelist.j2
new file mode 100644
index 000000000..1e05ac00f
--- /dev/null
+++ b/data/templates/ssh/sshguard_whitelist.j2
@@ -0,0 +1,7 @@
+### Autogenerated by ssh.py ###
+
+{% if dynamic_protection is vyos_defined and dynamic_protection.whitelist_address is vyos_defined %}
+{% for address in dynamic_protection.whitelist_address %}
+{{ address }}
+{% endfor %}
+{% endif %}