dasandClaude Opus 5.5
eba4516998
- server/ profile and build-iso.sh [desktop|server]; make iso-server, make qemu-server, run-qemu.sh --serial; login on tty and ttyS0 - das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose, nftables (closed except SSH, own table), fail2ban reading socklog, sshd without root passwords, Docker log rotation, tools - das-server-install: dialog installer in Ukrainian and English, or unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS, serial console, SSH key with optional keys-only logins - das-install-common: mount-source and postinstall shared with Calamares - dsv: runit service manager (list, enable, disable, start, stop, restart, status, logs) with bash completion, also on the desktop - das-update split into a subpackage without GTK; the window and tray icon move to /usr/libexec/das/das-update-gui - das-snapper-setup enables dbus, which snapper needs - TODO: ISO size review with measured numbers and options Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
16 lines
632 B
Plaintext
16 lines
632 B
Plaintext
# Das OS: ban addresses that keep failing SSH logins, through nftables.
|
|
[DEFAULT]
|
|
banaction = nftables-multiport
|
|
banaction_allports = nftables-allports
|
|
|
|
[sshd]
|
|
enabled = true
|
|
backend = polling
|
|
# socklog-void collects auth messages here. svlogd starts each line with a
|
|
# UTC time stamp; the pattern also consumes the facility and the syslog date
|
|
# that follow it, so the sshd filter sees "sshd-session[pid]: ...":
|
|
# 2026-10-19T17:25:46.09500 auth.info: Oct 19 20:25:46 sshd-session[1154]: Invalid user ...
|
|
logpath = /var/log/socklog/secure/current
|
|
datepattern = ^%%Y-%%m-%%dT%%H:%%M:%%S\.%%f(?: \S+: \S+ +\d+ \S+)?
|
|
logtimezone = UTC
|