Fail2ban setup

Protect the selected logging service without replacing unrelated jails or trusted-address policy. A process that is running may still have an inactive or ineffective jail.

Inspect

• Identify installed Fail2ban/filter versions, actual SSH listeners, active jails, local overrides and existing ignoreip values. Review administrator access before testing bans.
• Determine whether SSH events reach /var/log/auth.log, /var/log/secure, or only journald. For journal-only systems, confirm python3-systemd and the installed SSH filter's journalmatch support.
• Identify the firewall ban action and network path, including reverse proxies or containers if relevant. A jail must identify the actual offending client, not a shared proxy or administrator address.

Read references/fail2ban-filters.md when choosing backends, filter modes, custom application filters, or a controlled test.

Configure

Install Fail2ban and required backend packages within the authorized scope if absent. Preview scripts/setup-fail2ban.sh:

sudo bash scripts/setup-fail2ban.sh --dry-run