Files

T

Clément Désiles 40cc0efcf8 fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

strict makes /run read-only, which blocks ufw's /run/ufw.lock and
cannot be whitelisted via ReadWritePaths (the file does not exist).
full still protects /usr and /etc while leaving /run and /var writable,
so only /etc/ufw needs an explicit write path.

2026-09-05 16:28:55 +02:00

defaults

chore: ansible-lint

2025-11-02 21:18:15 +01:00

handlers

fix(fail2ban): start under ProtectSystem=strict hardening

2026-09-05 16:21:49 +02:00

tasks

fix(fail2ban): start under ProtectSystem=strict hardening

2026-09-05 16:21:49 +02:00

templates

fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

2026-09-05 16:28:55 +02:00

README.md

fix(fail2ban): use ProtectSystem=full so ufw can create its lock file

2026-09-05 16:28:55 +02:00

README.md

Fail2ban

Bans brute-force sources via UFW. Reads logs from the systemd journal (backend = systemd), so it works on both Arch and Debian.

Jails

sshd
nginx-http-auth

Notes

Logs to the journal (logtarget = STDOUT in fail2ban.local) — see journalctl -u fail2ban.
The systemd unit is hardened (ProtectSystem=full); the drop-in lives at /etc/systemd/system/fail2ban.service.d/override.conf and is fully managed by the role.
Firewall/banaction is UFW on every host; jails ban via ufw prepend reject.

Variables

See defaults/main.yml.

Verify

sudo fail2ban-client status
sudo fail2ban-client set sshd banip 192.0.2.1 && sudo ufw status | grep 192.0.2.1
sudo fail2ban-client set sshd unbanip 192.0.2.1