Fail2ban is an intrusion prevention software. It scans through log files to find signs of malicious intent. In general, Fail2ban will update the firewall rules to reject the offending IP address for a set amount of time.
The Fail2ban NixOS module can be found under services.fail2ban; from now on (unless differently specified), all options described are prefixed with this namespace.
The service can be enabled with the expression:
services.fail2ban.enable = true;
This will also enable a jail for sshd, which comes with NixOS.
Configuration
The Fail2ban NixOS module exposes different parameters for adjusting the configuration:
The maxretry option allows you to specify how many failures are required for an IP address to be blocked.
To prevent being locked out accidentally, the 'ignoreIP' option can be used to prevent IP addresses and IP ranges from being blocked. In the example below, common LAN IP address ranges as well as the specific IP '8.8.8.8' and the address associated with the hostname "nixos.wiki" (note that the loopback addresses "127.0.0.0/8" and "::1" are added by default).
bantime specifies for how much time an IP address is blocked after reaching the maximum number of tries. Note that the bantime can be increased for every violation by setting bantime-increment.enable to true; the bantime increment can then be customized by specifying a formula (in Python) like ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor) with bantime-increment.formula, the multipliers with bantime-increment.multipliers, the maximum bantime with bantime-increment.maxtime and the indication to consider the bans issued throughout multiple jails with bantime-increment.overalljails
banaction specifies which one among the actions contained in /etc/fail2ban/action.d should be the default banning action (e.g., iptables, iptables-new, iptables-multiport, iptables-ipset-proto6-allports, shorewall, etc.)
extraPackages can receive a list of derivations whose outputs are needed by Fail2ban actions
jails contains the configuration of each Fail2ban “jail”. A jail consists of an action (such as blocking a port using iptables) that is triggered when a filter applied to a log file triggers more than a certain number of times in a certain time period. Actions are defined in /etc/fail2ban/action.d, while filters are defined in /etc/fail2ban/filter.d.
extraSettings can contain parameters that are automatically applied to every jail config (i.e., in the [DEFAULT] section)
services.fail2ban = {
enable = true;
maxretry = 5; # Observe 5 violations before banning an IP
ignoreIP = [
# Whitelisting some subnets:
"10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16"
"8.8.8.8" # Whitelists a specific IP
"nixos.wiki" # Resolves the IP via DNS
];
bantime = "24h"; # Set bantime to one day
bantime-increment = {
enable = true; # Enable increment of bantime after each violation
formula = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
multipliers = "1 2 4 8 16 32 64";
maxtime = "168h"; # Do not ban for more than 1 week
overalljails = true; # Calculate the bantime based on all the violations
};
jails = {
apache-nohome-iptables = ''
# Block an IP address if it accesses a non-existent
# home directory more than 5 times in 10 minutes,
# since that indicates that it's scanning.
filter = apache-nohome
action = iptables-multiport[name=HTTP, port="http,https"]
logpath = /var/log/httpd/error_log*
backend = auto
findtime = 600
bantime = 600
maxretry = 5
'';
};
};
These settings are written to /etc/fail2ban/jail.local, where fail2ban will use them.
Extending Fail2ban
Fail2ban capabilities can be freely extended by adding new jails, filters, and actions; the first ones of them are already covered in the "Basic usage" section, while the other two need dedicated config files to be created in the /etc/fail2ban/filter.d and /etc/fail2ban/action.d folders.
In order to do this, you'll have to add a environment.etc section to your NixOS config file and specify there the contents of your custom actions and filters:
environment.etc = {
# Define an action that will trigger a Ntfy push notification upon the issue of every new ban
"fail2ban/action.d/ntfy.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
norestored = true # Needed to avoid receiving a new notification after every restart
actionban = curl -H "Title: <ip> has been banned" -d "<name> jail has banned <ip> from accessing $(hostname) after <failures> attempts of hacking the system." https://ntfy.sh/Fail2banNotifications
'');
# Defines a filter that detects URL probing by reading the Nginx access log
"fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
[Definition]
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
'');
};
The defined filters and actions can then be used in a new jail (created as seen above):
services.fail2ban = {
# --- snip ---
jails = {
ngnix-url-probe = ''
enabled = true
filter = nginx-url-probe
logpath = /var/log/nginx/access.log
action = %(action_)s[blocktype=DROP]
ntfy
backend = auto # Do not forget to specify this if your jail uses a log file
maxretry = 5
findtime = 600
'';
};
};
Regierungserklärung: Der Bundeskanzler zum AFD-Verbotsverfahren
Es gibt offensichtliche Bestrebungen, die sich gegen die verfassungsmäßige Ordnung der Bundesrepublik Deutschland richten. Das Kabinett wird zum Todestag von Walter Lübcke, am 2. Juni 2024, beim Bundesverfassungsgericht das Verbot der Partei „Alternative für Deutschland“ beantragen.
Machen Sie jetzt mit.
Falls Ihnen aus Ihrem Bekanntenkreis belastende Informationen zu verfassungsfeindlichen Bestrebungen vorliegen: Bitte melden Sie uns Ihre Informationen.
— Permalink
We are thrilled to announce that Roundcube project has found a new home with Nextcloud. Becoming a new steward for a popular webmail client trusted in highly regulated industries and among security-savvy users alike, we set sail to foster the growth and improvement of the project. This brings about a new milestone for global IT decentralization. Read on to understand why.
Just like any communication and productivity software, the email is being consumed by technology giants seeking to monopolize the daily tools companies and individuals use for work. Email communication is as relevant as ever and remains a tidbit for user acquisition. Without equally viable alternatives, businesses, governments, and individual users will slowly lose the grip on their own data.
Roundcube is a multilingual IMAP client with an application-like UI that offers MIME support, address book, folders, message search and spell checking. It provides ample security and privacy protection, including PGP, XSS resistance and brute force protection.
As a self-hosted solution, Roundcube offers a standard of privacy and security in mail communication that is seeing an unfortunate decline at the modern workplace. Its capabilities find application in highly regulated industries like education and government.
The client is a choice of notable universities including Harvard, Cambridge, Tata Institute in Mumbai, University of Victoria and government administrations with examples like India and the European Commission. CPanel includes Roundcube, enabling hosting via numerous service providers like HostGator, OVH, Telekom Italy and GoDaddy. It is the default mail system of the popular Synology NAS devices.
A partnership between privacy-centered projects like Nextcloud and Roundcube draws a complete picture of a decentralized collaboration ecosystem empowered by synergy of shared vision.
Before choice becomes an illusion, developers of independent solutions need to consolidate their efforts to establish a counter-force. Behind the new partnership stands our shared community-powered mission to respond to challenges brought by technological centralization, both for the public and private sector but also for private users.
The merger not only underscores the collective strength of the open source community but also highlights our enduring commitment to privacy, security, and user empowerment
Frank Karlitschek
Founder of Nextcloud
Together we can bring a new perspective to the digital Europe as a whole. And the collaboration grows the Nextcloud-led Coalition for a Level Playing Field, our anti-trust campaign which filed complaints about the anti-competitive behavior of Big Tech to the European Union and the German government.
The plan for the upcoming year includes the adaptation and advancement of Roundcube to create a complete offering that will fit a wide range of users. That involves continuous investment to accelerate and oversee the development process while serving the common vision the two projects have.
Both projects share the same ideology about the role and importance of free software as an independent alternative to the big cloud services.
Thomas Brüderli
Roundcube founder
What sets this collaboration apart is that both projects focus on user empowerment. Using Nextcloud or Roundcube, users can anticipate increased autonomy and control over their digital experiences. Both projects will continue to focus on self-hosting and privacy, as well as great user experiences.
Our short-term plan is to boost development, hiring some new team members for Roundcube. We also hope to support and grow the contributing community, inviting new talent to boost the development and health of the project.
As a product, Roundcube has an established path to success on its own. With opportunities remaining to be explored, a direct merger between Roundcube and Nextcloud is not planned. Neither will Roundcube replace Nextcloud Mail or the other way around. The products both have strengths and weaknesses and as open source products they already do share some underlying libraries and tools, but remain independent offerings for overlapping but different use scenarios. Nextcloud Mail will evolve as it is, focused on being used naturally within Nextcloud. Roundcube will continue to serve its active and new users as a stand-alone secure mail client.
“I‘ve been following the development of Nextcloud and Frank‘s tireless efforts for free software for years. It was the first name to come to my mind when I started thinking about the future of Roundcube.”
Frank Karlitschek and Thomas Brüderli, founders of Nextcloud and Roundcube respectively, discuss the past, the present, and the future of this partnership.
Roundcube community members, including users and contributors, are welcome to to join the conversation. As a new playground, we offer a separate Roundcube section on the Nextcloud forum where you can raise issues, start discussions, and get in touch with Nextcloud.
