add fail2ban

3 files changed, 25 insertions, 0 deletions

diff --git a/all b/all
index 789135f..deb639b 100644
--- a/all
+++ b/all
@@ -8,6 +8,7 @@ btrfs-progs
 delve
 dosfstools
 efibootmgr
+fail2ban
 fastfetch
 git
 go
@@ -39,6 +40,7 @@ pkgfile
 plocate
 proton-vpn-cli
 proton-vpn-gtk-app
+python-systemd
 reflector
 ripgrep
 rsync
diff --git a/etc.bash b/etc.bash
index fcd99a0..80a9310 100755
--- a/etc.bash
+++ b/etc.bash
@@ -25,6 +25,10 @@ sudo ufw logging low
 sudo ufw enable
 sudo systemctl enable --now ufw
 
+# fail2ban
+sudo cp ./etc/fail2ban/sshd.local /etc/fail2ban
+sudo systemctl enable --now fail2ban
+
 # fs trim
 sudo systemctl enable --now fstrim.timer
 
diff --git a/etc/fail2ban/sshd.local b/etc/fail2ban/sshd.local
new file mode 100644
index 0000000..89f16ec
--- /dev/null
+++ b/etc/fail2ban/sshd.local
@@ -0,0 +1,19 @@
+[DEFAULT]
+# Use UFW to execute IP bans
+banaction = ufw
+
+# Read logs directly from systemd journal (required for Arch Linux)
+backend = systemd
+
+# Ignore local traffic
+ignoreip = 127.0.0.1/8 ::1 192.168.1.0/24
+
+# Ban parameters
+findtime = 10m
+maxretry = 4
+bantime  = 1h
+
+[sshd]
+enabled = true
+port    = 22
+mode    = normal