soubory SODEW

2026-08-12 10:14:13 +02:00
parent 9fc81b53cc
commit f186ec26a8
116 changed files with 20087 additions and 0 deletions
@@ -0,0 +1,19 @@
+[sshd]
+enabled           = true
+backend           = systemd
+maxretry          = 4
+findtime          = 600
+bantime           = 3600
+bantime.increment = true
+bantime.factor    = 2
+bantime.maxtime   = 604800
+
+[recidive]
+enabled   = true
+backend   = systemd
+filter    = recidive
+logpath   = /var/log/fail2ban.log
+banaction = %(banaction_allports)s
+bantime   = 604800
+findtime  = 86400
+maxretry  = 3
@@ -0,0 +1,20 @@
+# --- KUBE SFTP GLOBAL BEGIN ---
+
+PermitRootLogin no
+PermitUserEnvironment no
+
+LoginGraceTime 30
+MaxAuthTries 3
+MaxSessions 5
+MaxStartups 200:30:500
+
+Compression no
+DebianBanner no
+
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
+PubkeyAcceptedAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
+
+# --- KUBE SFTP GLOBAL END ---
@@ -0,0 +1,22 @@
+# --- KUBE SFTP GROUP BEGIN ---
+
+Match Group {{sftp_access_group}}
+    ChrootDirectory %h
+    ForceCommand internal-sftp -d /www -u 027
+
+    PasswordAuthentication yes
+    KbdInteractiveAuthentication no
+    PubkeyAuthentication yes
+
+    PermitTTY no
+    PermitTunnel no
+
+    AllowTcpForwarding no
+    AllowAgentForwarding no
+    AllowStreamLocalForwarding no
+    X11Forwarding no
+
+    ClientAliveInterval 300
+    ClientAliveCountMax 2
+
+# --- KUBE SFTP GROUP END ---