Files

T

Clément Désiles 6355a9aae5 fix(fail2ban): ban via ufw deny (DROP) instead of reject

REJECT needs the nft_reject kernel extension, which is unavailable on
this Arch kernel (iptables-nft reports 'Extension REJECT revision 0
not supported'), so every ban silently failed. DROP works everywhere
and is quieter toward attackers.

2026-09-05 16:45:12 +02:00

defaults

fix(fail2ban): ban via ufw deny (DROP) instead of reject

2026-09-05 16:45:12 +02:00

handlers

fix(fail2ban): start under ProtectSystem=strict hardening

2026-09-05 16:21:49 +02:00

tasks

fix(fail2ban): start under ProtectSystem=strict hardening

2026-09-05 16:21:49 +02:00

templates

fix(fail2ban): ban via ufw deny (DROP) instead of reject

2026-09-05 16:45:12 +02:00

README.md

fix(fail2ban): ban via ufw deny (DROP) instead of reject

2026-09-05 16:45:12 +02:00

README.md

Fail2ban

Bans brute-force sources via UFW. Reads logs from the systemd journal (backend = systemd), so it works on both Arch and Debian.

Jails

sshd
nginx-http-auth

Notes

Logs to the journal (logtarget = STDOUT in fail2ban.local) — see journalctl -u fail2ban.
The systemd unit is hardened (ProtectSystem=full); the drop-in lives at /etc/systemd/system/fail2ban.service.d/override.conf and is fully managed by the role.
Firewall/banaction is UFW on every host; jails ban via ufw prepend deny (DROP — no kernel REJECT extension needed, and it doesn't reveal the host to attackers).

Variables

See defaults/main.yml.

Verify

sudo fail2ban-client status
sudo fail2ban-client set sshd banip 192.0.2.1 && sudo ufw status | grep 192.0.2.1
sudo fail2ban-client set sshd unbanip 192.0.2.1