officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

move fail2ban into core utils, and reduce its section to a status report

Browse Source 
Your call, and the reasoning holds: it configures nothing of its own, an existing
install with its own jails is untouched because pkg_install never names a package
that is already present, and it is worth having by default.

One thing recorded where it is declared, because it makes fail2ban unlike every
other entry in that list: it is a daemon, not a binary. Installing it starts it,
and Debian and Ubuntu ship an enabled sshd jail — so from that moment an address
that fails to log in five times in ten minutes is blocked for ten. That is the
point of it, and it includes you, from wherever you are connecting. (Recalled
rather than verified: fail2ban is not installed on this host and the sandbox
would not let me unpack the .deb to check the shipped jail.d file.)

The section no longer installs anything. It reports whether fail2ban is running,
which jails are active, and how to unban an address — because a daemon quietly
blocking connections is worth knowing about before it blocks yours, and a run
that installs it as one name in a list of twenty gives no hint that anything
started.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-12 18:52:14 +00:00
co-authored by Claude Opus 5
parent bdf13331ae
commit f176b92378
2 changed files with 54 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup/machine-setup/machine-setup.sh
+34 -1
View File
@@ -1170,13 +1170,46 @@ elif ! skip; then
step_ok
fi
# =============================================================================
# 18. fail2ban
# =============================================================================
#
# Installed as part of core utils rather than here — it is a distro package and
# nothing about it needs configuring. This step only reports what it is doing,
# because a daemon that silently blocks addresses is worth knowing is running.
step "fail2ban"
if ! skip; then
echo ""
info "fail2ban — blocks addresses that keep failing to log in"
if ! pkg_is_installed fail2ban; then
echo " not installed — it is part of core utils, which was declined or skipped"
SUMMARY+=("fail2ban: not installed")
elif systemctl is-active --quiet fail2ban 2>/dev/null; then
echo " running, and watching:"
fail2ban-client status 2>/dev/null | awk -F: '/Jail list/ { print " " $2 }' | xargs -r echo " "
echo ""
echo " Ubuntu enables the sshd jail by default: five failed logins from"
echo " one address within ten minutes blocks it for ten. That includes"
echo " you, from wherever you are connecting."
echo " Unban with: fail2ban-client set sshd unbanip <address>"
SUMMARY+=("fail2ban: running")
else
warn "installed but not running"
echo " start it with: systemctl enable --now fail2ban"
SUMMARY+=("fail2ban: installed but not running")
fi
step_ok
fi
# =============================================================================
# NOT PORTED YET
# =============================================================================
#
# Sections still to move across from scripts/setup-old/setup-ubuntu.sh, in order:
#
# fail2ban · unattended-upgrades ·
# unattended-upgrades ·
# git config · docker · zsh + prompt (incl. .tmux.conf) · tailscale · neovim · js runtimes ·
# dev tools · ufw · zshrc
#