jokester/ansible-playbooks
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(fail2ban): ban via ufw deny (DROP) instead of reject

Browse Source 
REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.
This commit is contained in:
Clément Désiles
2026-09-05 16:45:12 +02:00
parent 40cc0efcf8
commit 6355a9aae5
3 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/fail2ban/README.md
+1 -1
View File
@@ -11,7 +11,7 @@ Bans brute-force sources via UFW. Reads logs from the systemd journal (`backend
- Logs to the journal (`logtarget = STDOUT` in `fail2ban.local`) — see `journalctl -u fail2ban`.
- The systemd unit is hardened (`ProtectSystem=full`); the drop-in lives at `/etc/systemd/system/fail2ban.service.d/override.conf` and is fully managed by the role.
- Firewall/banaction is UFW on every host; jails ban via `ufw prepend reject`.
- Firewall/banaction is UFW on every host; jails ban via `ufw prepend deny` (DROP — no kernel `REJECT` extension needed, and it doesn't reveal the host to attackers).
## Variables