Clément Désiles
120615c38f
- log to journald via fail2ban.local (logtarget is a fail2ban.conf option, not jail.local) so the server can start without /var/log write access - create the socket dir via RuntimeDirectory=fail2ban instead of a non-creating ReadWritePaths entry - add ufw write paths so bans persist under the read-only namespace - manage override.conf unconditionally and restart on change
Fail2ban
Bans brute-force sources via UFW. Reads logs from the systemd journal (backend = systemd), so it works on both Arch and Debian.
Jails
sshdnginx-http-auth
Notes
- Logs to the journal (
logtarget = STDOUTinfail2ban.local) — seejournalctl -u fail2ban. - The systemd unit is hardened (
ProtectSystem=strict); the drop-in lives at/etc/systemd/system/fail2ban.service.d/override.confand is fully managed by the role. - Firewall/banaction is UFW on every host; jails ban via
ufw prepend reject.
Variables
See defaults/main.yml.
Verify
sudo fail2ban-client status
sudo fail2ban-client set sshd banip 192.0.2.1 && sudo ufw status | grep 192.0.2.1
sudo fail2ban-client set sshd unbanip 192.0.2.1