fail2ban: jails don't seem to work

[0xlua]

I currently have two fail2ban jails active:

• sshd: came as default with NixOS
• caddy: because of podman container hardening #168

However the sshd jail doesn't ban anything anymore. I haven't changed anything, so it could be related to the an OpenSSH Upgrade¹. The caddy jail also doesn't ban anything, which could just be a misconfiguration on my side².

But since both don't work anymore, it could also be an issue with fail2ban... tbd

Footnotes

1. Changelog: https://www.openssh.org/txt/release-10.4 ↩

2. Maybe the error lies with my journalmatch? See man-page: https://man.archlinux.org/man/systemd.journal-fields.7 ↩

[0xlua]

Alternative: switch to CrowdSec. NixOS includes the services.crowdsec option to configure Logs, Parsers and Remedies declaratively.

With CrowdSec I can block traffic both at the firewall level, as well as the WAF level with caddy¹.

CrowdSec supports Podman as a log source².

I then have to add log parsers for my services, for example:

• SSH
• Caddy
• Vaultwarden

Footnotes

1. I'll have to install caddy-l4 first, see caddy: add l4 plugin #211 ↩

2. I'll have to activate the podman socket first: virtualisation.podman.dockerSocket.enable ↩

[0xlua]

First double check the fail2ban service file using the Arch Wiki page, especially 4.2 systemd backend and 4.3 Service hardening

A list of guides for some of the services I run, in case I get fail2ban running again:

• Vaultwarden
• Caddy, also this one
• redlib
• rustypaste

[0xlua]

Use public blocklists together with fail2ban:

• AbuseIPDB
• www.BlockList.de

[0xlua]

https://github.com/lattn/caddy-ip-filter