jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

Browse Source 
strict makes /run read-only, which blocks ufw's /run/ufw.lock and
cannot be whitelisted via ReadWritePaths (the file does not exist).
full still protects /usr and /etc while leaving /run and /var writable,
so only /etc/ufw needs an explicit write path.
This commit is contained in:
Clément Désiles
2026-09-05 16:28:55 +02:00
parent 120615c38f
commit 40cc0efcf8
2 changed files with 2 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/fail2ban/README.md
+1 -1
View File
@@ -10,7 +10,7 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
## Notes
- Logs to the journal (`logtarget = STDOUT` in `fail2ban.local`) — see `journalctl -u fail2ban`.
- The systemd unit is hardened (`ProtectSystem=strict`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
- The systemd unit is hardened (`ProtectSystem=full`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
- Firewall/banaction is UFW on every host; jails ban via `ufw prepend reject`.
## Variables