Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Docs: Added Docker fail2ban configuration. #8642

Merged
merged 2 commits into from
Oct 23, 2019
Merged

Docs: Added Docker fail2ban configuration. #8642

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
49d3da7
Docs: Added instructions for Docker fail2ban configuration.
gnat Oct 23, 2019
44a2d89
Merge branch 'master' into docs_fail2ban_docker
gnat Oct 23, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions docs/content/doc/usage/fail2ban-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ on a bad authentication:
2018/04/26 18:15:54 [I] Failed authentication attempt for user from xxx.xxx.xxx.xxx
```

So we set our filter in `/etc/fail2ban/filter.d/gitea.conf`:
Add our filter in `/etc/fail2ban/filter.d/gitea.conf`:

```ini
# gitea.conf
Expand All @@ -35,12 +35,11 @@ failregex = .*Failed authentication attempt for .* from <HOST>
ignoreregex =
```

And configure it in `/etc/fail2ban/jail.d/jail.local`:
Add our jail in `/etc/fail2ban/jail.d/gitea.conf`:

```ini
[gitea]
enabled = true
port = http,https
filter = gitea
logpath = /home/git/gitea/log/gitea.log
maxretry = 10
Expand All @@ -49,6 +48,23 @@ bantime = 900
action = iptables-allports
```

If you're using Docker, you'll also need to add an additional jail to handle the **FORWARD**
chain in **iptables**. Configure it in `/etc/fail2ban/jail.d/gitea-docker.conf`:

```ini
[gitea-docker]
enabled = true
filter = gitea
logpath = /home/git/gitea/log/gitea.log
maxretry = 10
findtime = 3600
bantime = 900
action = iptables-allports[chain="FORWARD"]
```

Then simply run `service fail2ban restart` to apply your changes. You can check to see if
fail2ban has accepted your configuration using `service fail2ban status`.

Make sure and read up on fail2ban and configure it to your needs, this bans someone
for **15 minutes** (from all ports) when they fail authentication 10 times in an hour.

Expand Down