YunoHost/doc
1
0
Fork 0
mirror of https://github.com/YunoHost/doc.git synced 2024-09-03 20:06:26 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #815 from SylvainCecchetto/master

Browse source 
Update security doc -- fail2ban SSH port config
This commit is contained in:
Alexandre Aubin 2018-09-24 18:57:39 +02:00 • committed by GitHub
commit f6e5f2b006
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 49 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
security.md
View file

@ -77,6 +77,31 @@ yunohost firewall reload
yunohost firewall disallow <your_old_ssh_port_number> # port by default 22 yunohost firewall disallow <your_old_ssh_port_number> # port by default 22
``` ```
You also need to give fail2ban the new SSH port.
To do that you need to create the configuration file `my_ssh_port.conf` with the command
```bash
nano /etc/fail2ban/jail.d/my_ssh_port.conf
```
and you can fill it with
```
[sshd]
port = <votre_numero_de_port_ssh>
[sshd-ddos]
port = <votre_numero_de_port_ssh>
```
Finally you have to restart fail2ban in order to apply the new configuration
```bash
systemctl restart fail2ban.service
```
**For the next SSH connections ** you need to add the `-p` option followed by the SSH port number. **For the next SSH connections ** you need to add the `-p` option followed by the SSH port number.
**Sample**: **Sample**:

24
security_fr.md
View file

@ -91,6 +91,30 @@ yunohost firewall reload
yunohost firewall disallow TCP <votre numéro de port> # port par défaut 22 yunohost firewall disallow TCP <votre numéro de port> # port par défaut 22
``` ```
Il convient également de donner à fail2ban le nouveau port SSH à bloquer en cas de bannissement d'une adresse IP.
Pour cela il suffit de créer le fichier de configuration `my_ssh_port.conf` avec
```bash
nano /etc/fail2ban/jail.d/my_ssh_port.conf
```
et de le compléter ainsi :
```
[sshd]
port = <votre_numero_de_port_ssh>
[sshd-ddos]
port = <votre_numero_de_port_ssh>
```
Il reste enfin à relancer fail2ban pour prendre en compte la nouvelle configuration
```bash
systemctl restart fail2ban.service
```
**Pour les prochaines connexions SSH** il faudra ajouter l’option -p suivie du numéro de port SSH. **Pour les prochaines connexions SSH** il faudra ajouter l’option -p suivie du numéro de port SSH.
**Exemple** : **Exemple** :