Usage: stratum security <action> [arguments]   (module type: service)

fail2ban bans addresses that fail to log in too often (with nftables), plus
optional SSH and system hardening. Stratum writes only
/etc/fail2ban/jail.d/90-stratum.local, and only when you start, enable or
change something here - own fail2ban configuration (jail.local) stays.

Actions:
  status                    state, settings, services, hardening, whitelist,
                            bans and a short event summary
  start | stop              fail2ban on / off now (boot setting unchanged)
  enable | disable          on and at boot / off and not at boot
  restart                   write the configuration again and reload
  settings                  all settings with their values
  setting <key> <value>:
      type <name>             workstation | server | hypervisor | vm-guest -
                              resets ban settings and services to its defaults
      bantime 10m|1h|1d|1w    how long an address is banned
      maxretry <1-20>         failures before a ban
      findtime 10m|1h|1d      window in which failures are counted
      increment yes|no        repeated bans get longer (up to 1 week)
  toggles jails | set jails [id...]
                            protected services (only installed ones):
                            sshd, recidive, nginx-http-auth, nginx-botsearch,
                            apache-auth, dovecot, postfix
  toggles hardening | set hardening [id...]      (all off by default)
      ssh-keys-only           SSH only with keys (refused without any key)
      ssh-root-key            root only with a key (PermitRootLogin prohibit-password)
      ssh-limits              MaxAuthTries 3, LoginGraceTime 30
      net-sysctl              SYN cookies, no ICMP redirects / source routing
      kernel-sysctl           kptr_restrict, dmesg_restrict, ptrace_scope 1
  whitelist [add|remove <address|network>]   never banned
  banned                    banned addresses per service
  ban <address> [service]   ban an address now (default service: sshd)
  unban <address>           lift a ban
  events [hours]            important events (default 24 h): SSH logins,
                            failed logins, fail2ban bans, sudo, Docker,
                            watchdog
  confirm | rollback        keep / undo the last SSH change
  help                      show this help

Protection against locking yourself out:
  - starting fail2ban puts the addresses of open SSH connections on the
    whitelist;
  - a risky change (keys only without any key, maxretry 1-2 for an address
    not on the whitelist, banning your own address) is refused with exit
    status 3 unless STRATUM_FORCE=1 (the menu asks "Apply anyway?");
  - SSH changes must be confirmed within 120 seconds (stratum security
    confirm, "Keep" in the menu) - otherwise they are undone. Test a NEW
    login before you confirm.

Files:
  /etc/stratum/security.conf              settings
  /etc/fail2ban/jail.d/90-stratum.local   fail2ban (generated)
  /etc/ssh/sshd_config.d/10-stratum.conf  SSH hardening (generated)
  /etc/sysctl.d/90-stratum-security.conf  system hardening (generated)
Environment:
  STRATUM_FORCE=1                  apply a change despite a lock-out warning
  STRATUM_SECURITY_NOCONFIRM=1     no confirmation / rollback (for scripts)
