jokester/ansible-playbooks

Files

T

Clément Désiles 120615c38f fix(fail2ban): start under ProtectSystem=strict hardening

- log to journald via fail2ban.local (logtarget is a fail2ban.conf option,
  not jail.local) so the server can start without /var/log write access
- create the socket dir via RuntimeDirectory=fail2ban instead of a
  non-creating ReadWritePaths entry
- add ufw write paths so bans persist under the read-only namespace
- manage override.conf unconditionally and restart on change

2026-09-05 16:21:49 +02:00

779 B

Raw Blame History

Fail2ban

Bans brute-force sources via UFW. Reads logs from the systemd journal (backend = systemd), so it works on both Arch and Debian.

Jails

sshd
nginx-http-auth

Notes

Logs to the journal (logtarget = STDOUT in fail2ban.local) — see journalctl -u fail2ban.
The systemd unit is hardened (ProtectSystem=strict); the drop-in lives at /etc/systemd/system/fail2ban.service.d/override.conf and is fully managed by the role.
Firewall/banaction is UFW on every host; jails ban via ufw prepend reject.

Variables

See defaults/main.yml.

Verify

sudo fail2ban-client status
sudo fail2ban-client set sshd banip 192.0.2.1 && sudo ufw status | grep 192.0.2.1
sudo fail2ban-client set sshd unbanip 192.0.2.1