Jun 29 - Update: Fail2ban, welcome email, dunning sequence, escalation

2026-06-29 13:47:57 -04:00
parent c133b5d419
commit b00bbba2da
14 changed files with 414 additions and 1 deletions
@@ -0,0 +1,17 @@
+# /etc/fail2ban/filter.d/jqc-login.conf
+#
+# Detects repeated login failures from the JQC application log.
+# The app logs: WARNING LOGIN_FAILED | ip=<IP> username=<user>
+#
+# Deploy:
+#   sudo cp deploy/fail2ban/filter.d/jqc-login.conf /etc/fail2ban/filter.d/
+#   sudo cp deploy/fail2ban/jail.d/jqc.conf /etc/fail2ban/jail.d/
+#   sudo systemctl restart fail2ban
+#   sudo fail2ban-client status jqc-login   # verify
+
+[INCLUDES]
+before = common.conf
+
+[Definition]
+failregex = ^.*WARNING LOGIN_FAILED \| ip=<HOST> .*$
+ignoreregex =
@@ -0,0 +1,15 @@
+# /etc/fail2ban/jail.d/jqc.conf
+#
+# Jail for JQC login brute-force protection.
+# Bans IPs that fail login 5 times within 5 minutes for 1 hour.
+#
+# Adjust logpath to match your actual log file location.
+
+[jqc-login]
+enabled  = true
+filter   = jqc-login
+logpath  = /var/www/jqc/logs/jqc.log
+maxretry = 5
+findtime = 300
+bantime  = 3600
+action   = iptables-multiport[name=jqc, port="80,443", protocol=tcp]