histalek
d822f8544d
This hardens the fail2ban service by giving it only the capabilities and read/write access it needs. This is done in accordance to the Arch Wiki article [1] where further information about the needed capabilities and read/write paths can be found. [1] https://wiki.archlinux.org/title/Fail2ban#Service_hardening
13 lines
383 B
Django/Jinja
13 lines
383 B
Django/Jinja
{{ ansible_managed | comment }}
|
|
|
|
[Service]
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectHome=read-only
|
|
ProtectSystem=strict
|
|
ReadWritePaths=-/var/run/fail2ban
|
|
ReadWritePaths=-/var/lib/fail2ban
|
|
ReadWritePaths=-/var/log/fail2ban
|
|
ReadWritePaths=-/var/spool/postfix/maildrop
|
|
ReadWritePaths=-/run/xtables.lock
|
|
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
|