# Fail2Ban

Protects SSH on kaburusvr (49.13.202.144) against brute-force attacks.

## Configuration

Config file: `/etc/fail2ban/jail.local`

| Setting | Value | Notes |
|---------|-------|-------|
| bantime | 86400 (24h) | Incremental — doubles on repeat offenders, max 7 days |
| findtime | 900 (15 min) | Window to count failures in |
| maxretry | 5 | Failures before ban |
| mode | aggressive | Catches more attack patterns |
| banaction | nftables | Set in jail.d/defaults-debian.conf |

## Whitelisted networks

- `127.0.0.1/8` — localhost
- `::1` — IPv6 localhost  
- `100.64.0.0/10` — entire Tailscale CGNAT range (we and Hermes connect via Tailscale — never banned)

## Incremental banning

`bantime.increment = true` means repeat offenders get longer bans:
- 1st ban: 24h
- 2nd ban: 48h
- 3rd ban: 96h
- Max: 7 days (604800s)

## Management commands

```bash
# Check status
fail2ban-client status sshd

# Unban an IP (e.g. if you lock yourself out)
fail2ban-client set sshd unbanip 1.2.3.4

# Check current settings
fail2ban-client get sshd bantime
fail2ban-client get sshd maxretry
fail2ban-client get sshd findtime

# View ban log
tail -f /var/log/fail2ban.log

# Restart
systemctl restart fail2ban
```

## Hermes alerts

Hermes runs periodic security checks and sends Telegram alerts.
If you're getting frequent alerts, the likely causes are:
- **bantime too short** — attackers wait out the ban and return (was 10 min, fixed 2026-05-16)
- **Fail2Ban not triggering** — check `fail2ban-client status sshd` for ban count vs failure count
- **Background noise** — internet scanners are constant, this is normal if bans are happening

## Ubuntu caveat — ssh vs sshd unit name

On **Ubuntu** (kaburuaibox), the SSH service is `ssh.service`, not `sshd.service` (Debian uses `sshd.service`).

If Fail2Ban uses `backend = systemd` (as we do), the default sshd jail filter matches `_SYSTEMD_UNIT=sshd.service`, which doesn't exist on Ubuntu — making the jail **blind** to all failures.

**Fix:** Add an override in `/etc/fail2ban/jail.d/ssh-service-override.conf`:
```ini
[sshd]
journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=ssh
ignoreip = 127.0.0.1/8 ::1 192.168.0.0/24
```

The LAN `192.168.0.0/24` is whitelisted because all valid SSH access to kaburuaibox is internal.

## History

- 2026-05-12: Initial setup with Tailscale whitelist (100.64.0.0/10)
- 2026-05-16: Fixed bantime 600→86400, findtime 600→900, added incremental banning, aggressive mode
- 2026-07-01: Fixed Ubuntu unit name mismatch on kaburuaibox (sshd.service → ssh.service), added LAN whitelist