[DEFAULT]
bantime = {{ fail2ban_bantime }}
findtime = {{ fail2ban_findtime }}
maxretry = {{ fail2ban_maxretry }}
destemail = root@localhost
action = %(action_mw)s

# SSH Protection - Critical
[sshd]
enabled = true
port = {{ ssh_port }}
filter = sshd
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
maxretry = {{ fail2ban_ssh_maxretry }}
bantime = {{ fail2ban_ssh_bantime }}

# SSH DDoS Protection
[sshd-ddos]
enabled = true
port = {{ ssh_port }}
filter = sshd-ddos
backend = systemd
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
maxretry = {{ fail2ban_sshddos_maxretry }}
bantime = {{ fail2ban_sshddos_bantime }}

# Recidive (repeat offenders)
[recidive]
enabled = true
filter = recidive
logpath = /var/log/fail2ban.log
action = %(action_mwl)s
bantime = {{ fail2ban_recidive_bantime }}
maxretry = {{ fail2ban_recidive_maxretry }}