git.iko.soy/typeable/nixpkgs
on master help sign in
Merge pull request #100255 from nh2/sshd-default-log-level-info

sshd service: Default to INFO logLevel (upstream default)

commit959c4e82bc0972bae00f1501821812a7f27e1956 authorNiklas Hambüchen <mail@nh2.me> dateWed 23 Jun 2021, 02:06 (5 years ago) parent7e3d8fca48fea4
4 files changed+45−8
compare with master
unifiedsplit
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+21−2 nixos/doc/manual/release-notes/rl-2111.section.md+4 nixos/modules/services/networking/ssh/sshd.nix+2−5 nixos/modules/services/security/fail2ban.nix+18−1
nixos/doc/manual/from_md/release-notes/rl-2111.section.xml+21−2
@@ -321,7 +321,26 @@
321321 </section>
322322 <section xml:id="sec-release-21.11-notable-changes">
323323 <title>Other Notable Changes</title>
324− <para>
325− </para>
324+ <itemizedlist>
325+ <listitem>
326+ <para>
327+ The setting
328+ <link xlink:href="options.html#opt-services.openssh.logLevel"><literal>services.openssh.logLevel</literal></link>
329+ <literal>&quot;VERBOSE&quot;</literal>
330+ <literal>&quot;INFO&quot;</literal>. This brings NixOS in line
331+ with upstream and other Linux distributions, and reduces log
332+ spam on servers due to bruteforcing botnets.
333+ </para>
334+ <para>
335+ However, if
336+ <link xlink:href="options.html#opt-services.fail2ban.enable"><literal>services.fail2ban.enable</literal></link>
337+ is <literal>true</literal>, the <literal>fail2ban</literal>
338+ will override the verbosity to
339+ <literal>&quot;VERBOSE&quot;</literal>, so that
340+ <literal>fail2ban</literal> can observe the failed login
341+ attempts from the SSH logs.
342+ </para>
343+ </listitem>
344+ </itemizedlist>
326345 </section>
327346</section>
nixos/doc/manual/release-notes/rl-2111.section.md+4
@@ -79,3 +79,7 @@ In addition to numerous new and upgraded packages, this release has the followin
7979 old 2.7.7 version.
8080
8181## Other Notable Changes {#sec-release-21.11-notable-changes}
82+
83+- The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
84+
85+ However, if [`services.fail2ban.enable`](options.html#opt-services.fail2ban.enable) is `true`, the `fail2ban` will override the verbosity to `"VERBOSE"`, so that `fail2ban` can observe the failed login attempts from the SSH logs.
nixos/modules/services/networking/ssh/sshd.nix+2−5
@@ -351,15 +351,12 @@ in
351351
352352 logLevel = mkOption {
353353 type = types.enum [ "QUIET" "FATAL" "ERROR" "INFO" "VERBOSE" "DEBUG" "DEBUG1" "DEBUG2" "DEBUG3" ];
354− default = "VERBOSE";
354+ default = "INFO"; # upstream default
355355 description = ''
356356 Gives the verbosity level that is used when logging messages from sshd(8). The possible values are:
357− QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is VERBOSE. DEBUG and DEBUG1
357+ QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. The default is INFO. DEBUG and DEBUG1
358358 are equivalent. DEBUG2 and DEBUG3 each specify higher levels of debugging output. Logging with a DEBUG level
359359 violates the privacy of users and is not recommended.
360−
361− LogLevel VERBOSE logs user's key fingerprint on login.
362− Needed to have a clear audit track of which key was used to log in.
363360 '';
364361 };
365362
nixos/modules/services/security/fail2ban.nix+18−1
@@ -45,7 +45,12 @@ in
4545 enable = mkOption {
4646 default = false;
4747 type = types.bool;
48− description = "Whether to enable the fail2ban service.";
48+ description = ''
49+ Whether to enable the fail2ban service.
50+
51+ See the documentation of <option>services.fail2ban.jails</option>
52+ for what jails are enabled by default.
53+ '';
4954 };
5055
5156 package = mkOption {
@@ -221,6 +226,15 @@ in
221226 defined in <filename>/etc/fail2ban/action.d</filename>,
222227 while filters are defined in
223228 <filename>/etc/fail2ban/filter.d</filename>.
229+
230+ NixOS comes with a default <literal>sshd</literal> jail;
231+ for it to work well,
232+ <option>services.openssh.logLevel</option> should be set to
233+ <literal>"VERBOSE"</literal> or higher so that fail2ban
234+ can observe failed login attempts.
235+ This module sets it to <literal>"VERBOSE"</literal> if
236+ not set otherwise, so enabling fail2ban can make SSH logs
237+ more verbose.
224238 '';
225239 };
226240
@@ -313,6 +327,9 @@ in
313327 banaction_allports = ${cfg.banaction-allports}
314328 '';
315329 # Block SSH if there are too many failing connection attempts.
330+ # Benefits from verbose sshd logging to observe failed login attempts,
331+ # so we set that here unless the user overrode it.
332+ services.openssh.logLevel = lib.mkDefault "VERBOSE";
316333 services.fail2ban.jails.sshd = mkDefault ''
317334 enabled = true
318335 port = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}