move fail2ban into core utils, and reduce its section to a status report

Your call, and the reasoning holds: it configures nothing of its own, an existing
install with its own jails is untouched because pkg_install never names a package
that is already present, and it is worth having by default.

One thing recorded where it is declared, because it makes fail2ban unlike every
other entry in that list: it is a daemon, not a binary. Installing it starts it,
and Debian and Ubuntu ship an enabled sshd jail — so from that moment an address
that fails to log in five times in ten minutes is blocked for ten. That is the
point of it, and it includes you, from wherever you are connecting. (Recalled
rather than verified: fail2ban is not installed on this host and the sandbox
would not let me unpack the .deb to check the shipped jail.d file.)

The section no longer installs anything. It reports whether fail2ban is running,
which jails are active, and how to unban an address — because a daemon quietly
blocking connections is worth knowing about before it blocks yours, and a run
that installs it as one name in a list of twenty gives no hint that anything
started.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/packages.sh

@@ -51,11 +51,20 @@ LAST_SKIPPED=()
 # are the environment: nothing calls them, they are here because a box you use
 # should have them.
 #
-# build-essential is the one entry with any reach beyond itself: it is a
+# Two entries reach beyond simply existing on the machine.
-# meta-package (gcc, g++, make, libc6-dev, dpkg-dev), so on a machine where a
+#
-# specific gcc was pinned it pulls the distribution's default alongside it. It
+# fail2ban is not a tool, it is a daemon: installing it starts it, and Debian and
-# stays in core because anything that compiles a native module needs it, but it
+# Ubuntu ship an enabled sshd jail, so from that moment an address failing to log
-# is the one to move out first if that ever bites.
+# in five times in ten minutes is blocked for ten. That is the point of it, and it
+# is worth having by default — but it is why it appears here rather than being
+# thought of as another binary. An existing install with its own jails is
+# untouched, because pkg_install never names a package that is already there.
+#
+# build-essential is the other: a meta-package (gcc, g++, make, libc6-dev,
+# dpkg-dev), so on a machine where a specific gcc was pinned it pulls the
+# distribution's default alongside it. It stays in core because anything that
+# compiles a native module needs it, but it is the one to move out first if that
+# ever bites.
 pkgs_core() {
   case "$PM" in
     apt)
@@ -64,15 +73,18 @@ pkgs_core() {
       # fastfetch PPA. They have no counterpart on the other systems.
       echo curl ca-certificates gnupg git jq unzip \
         apt-transport-https lsb-release software-properties-common \
-        wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools
+        wget zip build-essential btop htop tree tmux ripgrep fd-find net-tools \
+        fail2ban
       ;;
     pacman)
       echo curl ca-certificates gnupg git jq unzip \
-        wget zip base-devel btop htop tree tmux ripgrep fd net-tools
+        wget zip base-devel btop htop tree tmux ripgrep fd net-tools \
+        fail2ban
       ;;
     dnf)
       echo curl ca-certificates gnupg2 git jq unzip \
-        wget zip btop htop tree tmux ripgrep fd-find net-tools
+        wget zip btop htop tree tmux ripgrep fd-find net-tools \
+        fail2ban
       ;;
     brew)
       # curl, unzip and the TLS roots ship with macOS; the compilers come from

scripts/setup/machine-setup/machine-setup.sh

@@ -1170,13 +1170,46 @@ elif ! skip; then
   step_ok
 fi
 
+# =============================================================================
+# 18. fail2ban
+# =============================================================================
+#
+# Installed as part of core utils rather than here — it is a distro package and
+# nothing about it needs configuring. This step only reports what it is doing,
+# because a daemon that silently blocks addresses is worth knowing is running.
+
+step "fail2ban"
+if ! skip; then
+  echo ""
+  info "fail2ban — blocks addresses that keep failing to log in"
+
+  if ! pkg_is_installed fail2ban; then
+    echo "     not installed — it is part of core utils, which was declined or skipped"
+    SUMMARY+=("fail2ban: not installed")
+  elif systemctl is-active --quiet fail2ban 2>/dev/null; then
+    echo "     running, and watching:"
+    fail2ban-client status 2>/dev/null | awk -F: '/Jail list/ { print "       " $2 }' | xargs -r echo "      "
+    echo ""
+    echo "     Ubuntu enables the sshd jail by default: five failed logins from"
+    echo "     one address within ten minutes blocks it for ten. That includes"
+    echo "     you, from wherever you are connecting."
+    echo "     Unban with:  fail2ban-client set sshd unbanip <address>"
+    SUMMARY+=("fail2ban: running")
+  else
+    warn "installed but not running"
+    echo "     start it with: systemctl enable --now fail2ban"
+    SUMMARY+=("fail2ban: installed but not running")
+  fi
+  step_ok
+fi
+
 # =============================================================================
 # NOT PORTED YET
 # =============================================================================
 #
 # Sections still to move across from scripts/setup-old/setup-ubuntu.sh, in order:
 #
-#   fail2ban · unattended-upgrades ·
+#   unattended-upgrades ·
 #   git config · docker · zsh + prompt (incl. .tmux.conf) · tailscale · neovim · js runtimes ·
 #   dev tools · ufw · zshrc
 #