officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

verify the fail2ban defaults instead of recalling them

Browse Source 
The previous commit hedged on the ban policy because I thought fail2ban was not
installed here. It is — the earlier ubuntu-setup run installed it — so the claim
could be checked rather than remembered.

Checked, and it was right: /etc/fail2ban/jail.d/defaults-debian.conf ships
`[sshd] enabled = true`, and the running jail reports maxretry 5, findtime 600,
bantime 600. This host has banned 6 addresses already.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-12 18:52:41 +00:00
co-authored by Claude Opus 5
parent f176b92378
commit 0da184d082
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup/machine-setup/lib/packages.sh
+7 -5
View File
@@ -53,11 +53,13 @@ LAST_SKIPPED=()
# #
# Two entries reach beyond simply existing on the machine. # Two entries reach beyond simply existing on the machine.
# #
# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and # fail2ban is not a tool, it is a daemon: installing it starts it, and Ubuntu
# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log # ships /etc/fail2ban/jail.d/defaults-debian.conf with `[sshd] enabled = true`.
# in five times in ten minutes is blocked for ten. That is the point of it, and it # Verified on this host — maxretry 5, findtime 600, bantime 600 — so from the
# is worth having by default — but it is why it appears here rather than being # moment it installs, an address failing to log in five times in ten minutes is
# thought of as another binary. An existing install with its own jails is # blocked for ten, including yours. That is the point of it and it is worth
# having by default, but it is why it belongs in this comment rather than being
# thought of as one more binary. An existing install with its own jails is
# untouched, because pkg_install never names a package that is already there. # untouched, because pkg_install never names a package that is already there.
# #
# build-essential is the other: a meta-package (gcc, g++, make, libc6-dev, # build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,