dffd8e3b76
Features: - PHP 8.4 support (from 8.3) - WordPress 7.0 (auto-update via WP-CLI) - Modern TLS 1.3 cipher suites (2026 best practices) - Fail2Ban security integration (5 jails: SSH, Nginx, WordPress, recidive) - Auto-update cron job for WordPress (weekly Minor updates) - Debian 14 Forky support (testing) - Ubuntu 25.04 support - Python 3.12 in GitHub Actions Security: - Fail2Ban with SSH brute force protection (24h ban) - WordPress wp-login.php protection (2h ban) - Nginx bot scanner protection - Recidive jail for repeat offenders (1 week ban) - Modern TLS ciphers (AEAD only) - HSTS 2 years for preload Documentation: - docs/autoupdate.md - WordPress auto-update guide - docs/fail2ban.md - Fail2Ban configuration guide - docs/troubleshooting.md - Updated with php_version variable Breaking changes: - PHP 8.4 is now the default (requires Ubuntu 20.04+ or Debian 11+)
68 lines
1.3 KiB
Django/Jinja
68 lines
1.3 KiB
Django/Jinja
# Fail2Ban configuration for WordPress LEMP stack
|
|
# Copy this to /etc/fail2ban/jail.local on your server
|
|
|
|
[DEFAULT]
|
|
# Global settings
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 5
|
|
|
|
# Your trusted IPs (never ban these)
|
|
ignoreip = 127.0.0.1/8 ::1
|
|
|
|
# Enable persistent database
|
|
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
|
|
dbpurgeage = 86400
|
|
|
|
# Incremental bans for repeat offenders
|
|
bantime.increment = true
|
|
bantime.multiplier = 2
|
|
bantime.maxtime = 86400
|
|
|
|
[sshd]
|
|
# SSH brute force protection
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
maxretry = 3
|
|
bantime = 86400
|
|
findtime = 300
|
|
|
|
[nginx-http-auth]
|
|
# Nginx HTTP Basic Auth failures
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-http-auth
|
|
logpath = /var/log/nginx/error.log
|
|
maxretry = 5
|
|
bantime = 3600
|
|
findtime = 600
|
|
|
|
[nginx-botsearch]
|
|
# Bot scanners searching for vulnerable scripts
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-botsearch
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 2
|
|
bantime = 7200
|
|
findtime = 300
|
|
|
|
[wordpress-login]
|
|
# WordPress wp-login.php protection
|
|
enabled = true
|
|
port = http,https
|
|
filter = wordpress-login
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 5
|
|
bantime = 7200
|
|
findtime = 600
|
|
|
|
[recidive]
|
|
# Ban repeat offenders for a week
|
|
enabled = true
|
|
filter = recidive
|
|
logpath = /var/log/fail2ban.log
|
|
maxretry = 3
|
|
bantime = 604800
|
|
findtime = 86400 |