Skip to content

Commit c2fca23

Browse files
gnatzeripath
authored andcommitted
Docs: Added instructions for Docker fail2ban configuration. (#8642)
1 parent b4b0e22 commit c2fca23

File tree

1 file changed

+19
-3
lines changed

1 file changed

+19
-3
lines changed

docs/content/doc/usage/fail2ban-setup.md

+19-3
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ on a bad authentication:
2626
2018/04/26 18:15:54 [I] Failed authentication attempt for user from xxx.xxx.xxx.xxx
2727
```
2828

29-
So we set our filter in `/etc/fail2ban/filter.d/gitea.conf`:
29+
Add our filter in `/etc/fail2ban/filter.d/gitea.conf`:
3030

3131
```ini
3232
# gitea.conf
@@ -35,12 +35,11 @@ failregex = .*Failed authentication attempt for .* from <HOST>
3535
ignoreregex =
3636
```
3737

38-
And configure it in `/etc/fail2ban/jail.d/jail.local`:
38+
Add our jail in `/etc/fail2ban/jail.d/gitea.conf`:
3939

4040
```ini
4141
[gitea]
4242
enabled = true
43-
port = http,https
4443
filter = gitea
4544
logpath = /home/git/gitea/log/gitea.log
4645
maxretry = 10
@@ -49,6 +48,23 @@ bantime = 900
4948
action = iptables-allports
5049
```
5150

51+
If you're using Docker, you'll also need to add an additional jail to handle the **FORWARD**
52+
chain in **iptables**. Configure it in `/etc/fail2ban/jail.d/gitea-docker.conf`:
53+
54+
```ini
55+
[gitea-docker]
56+
enabled = true
57+
filter = gitea
58+
logpath = /home/git/gitea/log/gitea.log
59+
maxretry = 10
60+
findtime = 3600
61+
bantime = 900
62+
action = iptables-allports[chain="FORWARD"]
63+
```
64+
65+
Then simply run `service fail2ban restart` to apply your changes. You can check to see if
66+
fail2ban has accepted your configuration using `service fail2ban status`.
67+
5268
Make sure and read up on fail2ban and configure it to your needs, this bans someone
5369
for **15 minutes** (from all ports) when they fail authentication 10 times in an hour.
5470

0 commit comments

Comments
 (0)