officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move fail2ban into core utils, and reduce its section to a status report

Browse Source 
Your call, and the reasoning holds: it configures nothing of its own, an existing
install with its own jails is untouched because pkg_install never names a package
that is already present, and it is worth having by default.

One thing recorded where it is declared, because it makes fail2ban unlike every
other entry in that list: it is a daemon, not a binary. Installing it starts it,
and Debian and Ubuntu ship an enabled sshd jail — so from that moment an address
that fails to log in five times in ten minutes is blocked for ten. That is the
point of it, and it includes you, from wherever you are connecting. (Recalled
rather than verified: fail2ban is not installed on this host and the sandbox
would not let me unpack the .deb to check the shipped jail.d file.)

The section no longer installs anything. It reports whether fail2ban is running,
which jails are active, and how to unban an address — because a daemon quietly
blocking connections is worth knowing about before it blocks yours, and a run
that installs it as one name in a list of twenty gives no hint that anything
started.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-12 18:52:14 +00:00
co-authored by Claude Opus 5
parent bdf13331ae
commit f176b92378
2 changed files with 54 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup/machine-setup/lib/packages.sh
+20 -8
View File
@@ -51,11 +51,20 @@ LAST_SKIPPED=()
# are the environment: nothing calls them, they are here because a box you use
# should have them.
#
# build-essential is the one entry with any reach beyond itself: it is a
# meta-package (gcc, g++, make, libc6-dev, dpkg-dev), so on a machine where a
# specific gcc was pinned it pulls the distribution's default alongside it. It
# stays in core because anything that compiles a native module needs it, but it
# is the one to move out first if that ever bites.
# Two entries reach beyond simply existing on the machine.
#
# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and
# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log
# in five times in ten minutes is blocked for ten. That is the point of it, and it
# is worth having by default — but it is why it appears here rather than being
# thought of as another binary. An existing install with its own jails is
# untouched, because pkg_install never names a package that is already there.
#
# build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,
# dpkg-dev), so on a machine where a specific gcc was pinned it pulls the
# distribution's default alongside it. It stays in core because anything that
# compiles a native module needs it, but it is the one to move out first if that
# ever bites.
pkgs_core() {
case "$PM" in
apt)
@@ -64,15 +73,18 @@ pkgs_core() {
# fastfetch PPA. They have no counterpart on the other systems.
echo curl ca-certificates gnupg git jq unzip \
apt-transport-https lsb-release software-properties-common \
wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools
wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools \
fail2ban
;;
pacman)
echo curl ca-certificates gnupg git jq unzip \
wget zip base-devel btop htop tree tmux ripgrep fd net-tools
wget zip base-devel btop htop tree tmux ripgrep fd net-tools \
fail2ban
;;
dnf)
echo curl ca-certificates gnupg2 git jq unzip \
wget zip btop htop tree tmux ripgrep fd-find net-tools
wget zip btop htop tree tmux ripgrep fd-find net-tools \
fail2ban
;;
brew)
# curl, unzip and the TLS roots ship with macOS; the compilers come from