jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(fail2ban): start under ProtectSystem=strict hardening

Browse Source 
- log to journald via fail2ban.local (logtarget is a fail2ban.conf option,
  not jail.local) so the server can start without /var/log write access
- create the socket dir via RuntimeDirectory=fail2ban instead of a
  non-creating ReadWritePaths entry
- add ufw write paths so bans persist under the read-only namespace
- manage override.conf unconditionally and restart on change
This commit is contained in:
Clément Désiles
2026-09-05 16:21:49 +02:00
parent ceca06ff2e
commit 120615c38f
5 changed files with 50 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/fail2ban/templates/hardened.fail2ban.conf.j2
+4 -2
View File
@@ -3,9 +3,11 @@ PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=strict
ReadWritePaths=-/var/run/fail2ban
RuntimeDirectory=fail2ban
RuntimeDirectoryMode=0750
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/var/log/fail2ban.log
ReadWritePaths=-/var/spool/postfix/maildrop
ReadWritePaths=-/run/xtables.lock
ReadWritePaths=-/etc/ufw
ReadWritePaths=-/var/lib/ufw
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW