From 1ede3d3329a0fd9a9936ecde1c33769f40d76fb3 Mon Sep 17 00:00:00 2001 From: Ruakij Date: Tue, 13 Oct 2026 16:36:08 +0000 Subject: [PATCH] Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start --- common/handlers/main.yml | 5 +++++ common/tasks/fail2ban.yml | 9 +++++++++ common/tasks/main.yml | 2 ++ 3 files changed, 16 insertions(+) create mode 100644 common/tasks/fail2ban.yml diff --git a/common/handlers/main.yml b/common/handlers/main.yml index e77d0ef..46df04c 100644 --- a/common/handlers/main.yml +++ b/common/handlers/main.yml @@ -5,3 +5,8 @@ systemd: name: systemd-journald state: restarted + +- name: restart_fail2ban + systemd: + name: fail2ban + state: restarted diff --git a/common/tasks/fail2ban.yml b/common/tasks/fail2ban.yml new file mode 100644 index 0000000..8b2fab8 --- /dev/null +++ b/common/tasks/fail2ban.yml @@ -0,0 +1,9 @@ +# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the +# file-based sshd jail refuses to start; read sshd from the journal instead. +- name: Read the sshd jail from the journal + copy: + dest: /etc/fail2ban/jail.d/sshd-systemd.conf + content: | + [sshd] + backend = systemd + notify: restart_fail2ban diff --git a/common/tasks/main.yml b/common/tasks/main.yml index 4657896..6a40538 100755 --- a/common/tasks/main.yml +++ b/common/tasks/main.yml @@ -1,5 +1,7 @@ - import_tasks: ./packages.yml +- import_tasks: ./fail2ban.yml + - import_tasks: ./ssh.yml - import_tasks: ./packages.yml