From 0da184d08294bfeefdc6cb2e176d8122e0457d33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Wed, 12 Aug 2026 18:52:41 +0000 Subject: [PATCH] verify the fail2ban defaults instead of recalling them MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The previous commit hedged on the ban policy because I thought fail2ban was not installed here. It is — the earlier ubuntu-setup run installed it — so the claim could be checked rather than remembered. Checked, and it was right: /etc/fail2ban/jail.d/defaults-debian.conf ships `[sshd] enabled = true`, and the running jail reports maxretry 5, findtime 600, bantime 600. This host has banned 6 addresses already. Co-Authored-By: Claude Opus 5 (1M context) --- scripts/setup/machine-setup/lib/packages.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/scripts/setup/machine-setup/lib/packages.sh b/scripts/setup/machine-setup/lib/packages.sh index 865a5e08..30340db5 100644 --- a/scripts/setup/machine-setup/lib/packages.sh +++ b/scripts/setup/machine-setup/lib/packages.sh @@ -53,11 +53,13 @@ LAST_SKIPPED=() # # Two entries reach beyond simply existing on the machine. # -# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and -# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log -# in five times in ten minutes is blocked for ten. That is the point of it, and it -# is worth having by default — but it is why it appears here rather than being -# thought of as another binary. An existing install with its own jails is +# fail2ban is not a tool, it is a daemon: installing it starts it, and Ubuntu +# ships /etc/fail2ban/jail.d/defaults-debian.conf with `[sshd] enabled = true`. +# Verified on this host — maxretry 5, findtime 600, bantime 600 — so from the +# moment it installs, an address failing to log in five times in ten minutes is +# blocked for ten, including yours. That is the point of it and it is worth +# having by default, but it is why it belongs in this comment rather than being +# thought of as one more binary. An existing install with its own jails is # untouched, because pkg_install never names a package that is already there. # # build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,