Clément Désiles
120615c38f
- log to journald via fail2ban.local (logtarget is a fail2ban.conf option, not jail.local) so the server can start without /var/log write access - create the socket dir via RuntimeDirectory=fail2ban instead of a non-creating ReadWritePaths entry - add ufw write paths so bans persist under the read-only namespace - manage override.conf unconditionally and restart on change
14 lines
388 B
Django/Jinja
14 lines
388 B
Django/Jinja
[Service]
|
|
PrivateDevices=yes
|
|
PrivateTmp=yes
|
|
ProtectHome=read-only
|
|
ProtectSystem=strict
|
|
RuntimeDirectory=fail2ban
|
|
RuntimeDirectoryMode=0750
|
|
ReadWritePaths=-/var/lib/fail2ban
|
|
ReadWritePaths=-/var/spool/postfix/maildrop
|
|
ReadWritePaths=-/run/xtables.lock
|
|
ReadWritePaths=-/etc/ufw
|
|
ReadWritePaths=-/var/lib/ufw
|
|
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW
|