Read the fail2ban sshd jail from the journal, Debian 12+ has no auth.log and the jail failed to start

2026-10-13 16:36:08 +00:00
parent deb3521bfa
commit 1ede3d3329
3 changed files with 16 additions and 0 deletions
@@ -0,0 +1,9 @@
+# Debian 12+ ships no syslog daemon, so there is no /var/log/auth.log and the
+# file-based sshd jail refuses to start; read sshd from the journal instead.
+- name: Read the sshd jail from the journal
+  copy:
+    dest: /etc/fail2ban/jail.d/sshd-systemd.conf
+    content: |
+      [sshd]
+      backend = systemd
+  notify: restart_fail2ban