ilyakooo0/nixpkgs
1
0
Fork 0
mirror of https://github.com/ilyakooo0/nixpkgs.git synced 2025-01-07 14:00:59 +03:00
Code Issues Projects Releases Wiki Activity

nixos/sshguard: fix syslog ids, no more pid file, cleanups

Browse Source 
1. Allow syslog identifiers with special characters
2. Do not write a pid file as we are running in foreground anyway
3. Clean up the module for readability

Without this, when deploying using nixops, restarting sshguard would make
nixops show an error about restarting the service although the service is
actually being restarted.
This commit is contained in:
Peter Hoeg 2019-01-23 18:20:28 +08:00
parent bc41317e24
commit ee472e4521
1 changed files with 48 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

95
nixos/modules/services/security/sshguard.nix
View File

@ -4,6 +4,7 @@ with lib;
let let
cfg = config.services.sshguard; cfg = config.services.sshguard;
in { in {
###### interface ###### interface
@ -77,65 +78,65 @@ in {
Systemd services sshguard should receive logs of. Systemd services sshguard should receive logs of.
''; '';
}; };
}; };
}; };
###### implementation ###### implementation
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.sshguard pkgs.iptables pkgs.ipset ];
environment.etc."sshguard.conf".text = let environment.etc."sshguard.conf".text = let
list_services = ( name: "-t ${name} "); args = lib.concatStringsSep " " ([
in '' "-afb"
BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset" "-p info"
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl -afb -p info -n1 ${toString (map list_services cfg.services)} -o cat" "-o cat"
"-n1"
] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
in ''
BACKEND="${pkgs.sshguard}/libexec/sshg-fw-ipset"
LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
'';
systemd.services.sshguard = {
description = "SSHGuard brute-force attacks protection system";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service";
path = with pkgs; [ iptables ipset iproute systemd ];
postStart = ''
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6
${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP
''; '';
systemd.services.sshguard = preStop = ''
{ description = "SSHGuard brute-force attacks protection system"; ${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP
${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP
'';
wantedBy = [ "multi-user.target" ]; unitConfig.Documentation = "man:sshguard(8)";
after = [ "network.target" ];
partOf = optional config.networking.firewall.enable "firewall.service";
path = [ pkgs.iptables pkgs.ipset pkgs.iproute pkgs.systemd ]; serviceConfig = {
Type = "simple";
postStart = '' ExecStart = let
mkdir -p /var/lib/sshguard args = lib.concatStringsSep " " ([
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard4 hash:ip family inet "-a ${toString cfg.attack_threshold}"
${pkgs.ipset}/bin/ipset -quiet create -exist sshguard6 hash:ip family inet6 "-p ${toString cfg.blocktime}"
${pkgs.iptables}/bin/iptables -I INPUT -m set --match-set sshguard4 src -j DROP "-s ${toString cfg.detection_time}"
${pkgs.iptables}/bin/ip6tables -I INPUT -m set --match-set sshguard6 src -j DROP (optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file}")
''; ] ++ (map (name: "-w ${escapeShellArg name}") cfg.whitelist));
in "${pkgs.sshguard}/bin/sshguard ${args}";
preStop = '' Restart = "always";
${pkgs.iptables}/bin/iptables -D INPUT -m set --match-set sshguard4 src -j DROP ProtectSystem = "strict";
${pkgs.iptables}/bin/ip6tables -D INPUT -m set --match-set sshguard6 src -j DROP ProtectHome = "tmpfs";
''; RuntimeDirectory = "sshguard";
StateDirectory = "sshguard";
unitConfig.Documentation = "man:sshguard(8)"; CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
serviceConfig = {
Type = "simple";
ExecStart = let
list_whitelist = ( name: "-w ${name} ");
in ''
${pkgs.sshguard}/bin/sshguard -a ${toString cfg.attack_threshold} ${optionalString (cfg.blacklist_threshold != null) "-b ${toString cfg.blacklist_threshold}:${cfg.blacklist_file} "}-i /run/sshguard/sshguard.pid -p ${toString cfg.blocktime} -s ${toString cfg.detection_time} ${toString (map list_whitelist cfg.whitelist)}
'';
PIDFile = "/run/sshguard/sshguard.pid";
Restart = "always";
ReadOnlyDirectories = "/";
ReadWriteDirectories = "/run/sshguard /var/lib/sshguard";
RuntimeDirectory = "sshguard";
StateDirectory = "sshguard";
CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_RAW";
};
}; };
};
}; };
} }