@@ -15,11 +15,11 @@ menu:
1515
1616# Fail2ban setup to block users after failed login attempts
1717
18- ** Remember that fail2ban is powerful and can cause lots of issues if you do it incorrectly, so make
18+ ** Remember that fail2ban is powerful and can cause lots of issues if you do it incorrectly, so make
1919sure to test this before relying on it so you don't lock yourself out.**
2020
21- Gitea returns an HTTP 200 for bad logins in the web logs, but if you have logging options on in
22- ` app.ini ` , then you should be able to go off of ` log/gitea.log ` , which gives you something like this
21+ Gitea returns an HTTP 200 for bad logins in the web logs, but if you have logging options on in
22+ ` app.ini ` , then you should be able to go off of ` log/gitea.log ` , which gives you something like this
2323on a bad authentication:
2424
2525``` log
@@ -41,14 +41,14 @@ Add our jail in `/etc/fail2ban/jail.d/gitea.conf`:
4141[gitea]
4242enabled = true
4343filter = gitea
44- logpath = /home/git /gitea/log/gitea.log
44+ logpath = /var/lib /gitea/log/gitea.log
4545maxretry = 10
4646findtime = 3600
4747bantime = 900
4848action = iptables-allports
4949```
5050
51- If you're using Docker, you'll also need to add an additional jail to handle the ** FORWARD**
51+ If you're using Docker, you'll also need to add an additional jail to handle the ** FORWARD**
5252chain in ** iptables** . Configure it in ` /etc/fail2ban/jail.d/gitea-docker.conf ` :
5353
5454``` ini
@@ -62,14 +62,14 @@ bantime = 900
6262action = iptables-allports[chain =" FORWARD" ]
6363```
6464
65- Then simply run ` service fail2ban restart ` to apply your changes. You can check to see if
65+ Then simply run ` service fail2ban restart ` to apply your changes. You can check to see if
6666fail2ban has accepted your configuration using ` service fail2ban status ` .
6767
68- Make sure and read up on fail2ban and configure it to your needs, this bans someone
68+ Make sure and read up on fail2ban and configure it to your needs, this bans someone
6969for ** 15 minutes** (from all ports) when they fail authentication 10 times in an hour.
7070
7171If you run Gitea behind a reverse proxy with Nginx (for example with Docker), you need to add
72- this to your Nginx configuration so that IPs don't show up as 127.0.0.1:
72+ this to your Nginx configuration so that IPs don't show up as 127.0.0.1:
7373
7474```
7575proxy_set_header X-Real-IP $remote_addr;
0 commit comments