config/etc/apt/apt.conf.d/20auto-upgrades at 26c8e345c57037c3e4566daea35aa792cd4f1ef9 - config - Gitea: Git with a cup of tea

Files

T

bastien 55ede6f08c feat(install): security baseline: fail2ban, unattended-upgrades, sshd hardening

Always applied in the Linux block, no prompt, idempotent:
- install_fail2ban: fail2ban + nftables, etc/fail2ban/jail.d/local.conf.
  sshd jail reads the journal (backend systemd, works with or without
  auth.log) and bans the offender on every port, so the SSH port is
  irrelevant: the previous server's jail banned 22 while sshd listened
  on 337. 5 failures / 10 min / 1 h. Loopback + RFC1918 never banned.
- install_unattended_upgrades: package + 20auto-upgrades (the file
  dpkg-reconfigure writes, without the prompt).
- harden_sshd: sshd_config.d/20-hardening.conf (PermitRootLogin no,
  MaxAuthTries 3, LoginGraceTime 20), sshd -t gated: a rejected file is
  removed and the install continues with a warning. Auth methods, port
  and user lists untouched.
Docs: README table + step 13 + packages, CLAUDE.md layout.

2026-09-22 17:47:34 +02:00

5 lines

227 B

Plaintext

Raw Blame History

 // Automatic security updates, deployed by install.sh. Same content as
 // `dpkg-reconfigure -plow unattended-upgrades` writes, without the prompt.
 APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";