From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001
From: Lukasz Kasprzak <lukasz.kasprzak@pm.me>
Date: Fri, 20 Mar 2026 19:16:32 +0100
Subject: feat: first fully successful run e2e on straper

---
 .../public/fail2ban/etc-fail2ban/jail.d/99-sshd.local  |  3 +++
 .../fail2ban/etc-fail2ban/jail.d/defaults-debian.conf  |  8 ++++++++
 .../etc-fail2ban/jail.d/sshd-session-preauth.local     | 18 ++++++++++++++++++
 .../db/public/fail2ban/etc-fail2ban/jail.d/sshd.local  |  3 +++
 .../public/fail2ban/etc-fail2ban/jail.d/sshd.local.bak |  5 +++++
 5 files changed, 37 insertions(+)
 create mode 100644 straper/db/public/fail2ban/etc-fail2ban/jail.d/99-sshd.local
 create mode 100644 straper/db/public/fail2ban/etc-fail2ban/jail.d/defaults-debian.conf
 create mode 100644 straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd-session-preauth.local
 create mode 100644 straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local
 create mode 100644 straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local.bak

(limited to 'straper/db/public/fail2ban/etc-fail2ban/jail.d')

diff --git a/straper/db/public/fail2ban/etc-fail2ban/jail.d/99-sshd.local b/straper/db/public/fail2ban/etc-fail2ban/jail.d/99-sshd.local
new file mode 100644
index 0000000..c8b55ce
--- /dev/null
+++ b/straper/db/public/fail2ban/etc-fail2ban/jail.d/99-sshd.local
@@ -0,0 +1,3 @@
+[sshd]
+enabled = true
+
diff --git a/straper/db/public/fail2ban/etc-fail2ban/jail.d/defaults-debian.conf b/straper/db/public/fail2ban/etc-fail2ban/jail.d/defaults-debian.conf
new file mode 100644
index 0000000..b060b72
--- /dev/null
+++ b/straper/db/public/fail2ban/etc-fail2ban/jail.d/defaults-debian.conf
@@ -0,0 +1,8 @@
+[DEFAULT]
+banaction = nftables
+banaction_allports = nftables[type=allports]
+
+[sshd]
+backend = systemd
+journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=sshd
+enabled = true
diff --git a/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd-session-preauth.local b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd-session-preauth.local
new file mode 100644
index 0000000..a2b9f78
--- /dev/null
+++ b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd-session-preauth.local
@@ -0,0 +1,18 @@
+[sshd-session-preauth]
+enabled  = true
+backend  = systemd
+filter   = sshd-session-preauth
+# journal match: use the unit and/or the SYSLOG_IDENTIFIER seen in logs
+journalmatch = _SYSTEMD_UNIT=ssh.service + SYSLOG_IDENTIFIER=sshd-session
+
+# Your SSH is on 57385; Fail2ban does not need it for matching, but does for actions:
+port     = 57385
+mode     = aggressive
+
+# Thresholds (safe defaults; adjust later)
+findtime = 10m
+maxretry = 5
+bantime  = 24h
+
+# nftables action (single-IP bans)
+banaction = nftables
diff --git a/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local
new file mode 100644
index 0000000..c8b55ce
--- /dev/null
+++ b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local
@@ -0,0 +1,3 @@
+[sshd]
+enabled = true
+
diff --git a/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local.bak b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local.bak
new file mode 100644
index 0000000..d37ee98
--- /dev/null
+++ b/straper/db/public/fail2ban/etc-fail2ban/jail.d/sshd.local.bak
@@ -0,0 +1,5 @@
+[sshd]
+enabled = true
+backend = systemd
+filter = sshd-session-preauth
+action = nftables-multiport
-- 
cgit v1.3