# Fail2Ban

Protects SSH on kaburusvr (49.13.202.144) against brute-force attacks.

## Configuration

Config file: `/etc/fail2ban/jail.local`

Setting Value Notes
—————-——-
bantime 86400 (24h) Incremental — doubles on repeat offenders, max 7 days
findtime 900 (15 min) Window to count failures in
maxretry 5 Failures before ban
mode aggressive Catches more attack patterns
banaction nftables Set in jail.d/defaults-debian.conf

## Whitelisted networks

- `127.0.0.1/8` — localhost - `::1` — IPv6 localhost - `100.64.0.0/10` — entire Tailscale CGNAT range (we and Hermes connect via Tailscale — never banned)

## Incremental banning

`bantime.increment = true` means repeat offenders get longer bans: - 1st ban: 24h - 2nd ban: 48h - 3rd ban: 96h - Max: 7 days (604800s)

## Management commands

```bash # Check status fail2ban-client status sshd

# Unban an IP (e.g. if you lock yourself out) fail2ban-client set sshd unbanip 1.2.3.4

# Check current settings fail2ban-client get sshd bantime fail2ban-client get sshd maxretry fail2ban-client get sshd findtime

# View ban log tail -f /var/log/fail2ban.log

# Restart systemctl restart fail2ban ```

## Hermes alerts

Hermes runs periodic security checks and sends Telegram alerts. If you're getting frequent alerts, the likely causes are: - bantime too short — attackers wait out the ban and return (was 10 min, fixed 2026-05-16) - Fail2Ban not triggering — check `fail2ban-client status sshd` for ban count vs failure count - Background noise — internet scanners are constant, this is normal if bans are happening

## Ubuntu caveat — ssh vs sshd unit name

On Ubuntu (kaburuaibox), the SSH service is `ssh.service`, not `sshd.service` (Debian uses `sshd.service`).

If Fail2Ban uses `backend = systemd` (as we do), the default sshd jail filter matches `_SYSTEMD_UNIT=sshd.service`, which doesn't exist on Ubuntu — making the jail blind to all failures.

Fix: Add an override in `/etc/fail2ban/jail.d/ssh-service-override.conf`: ```ini [sshd] journalmatch = _SYSTEMD_UNIT=ssh.service + _COMM=ssh ignoreip = 127.0.0.1/8 ::1 192.168.0.0/24 ```

The LAN `192.168.0.0/24` is whitelisted because all valid SSH access to kaburuaibox is internal.

## History

- 2026-05-12: Initial setup with Tailscale whitelist (100.64.0.0/10) - 2026-05-16: Fixed bantime 600→86400, findtime 600→900, added incremental banning, aggressive mode - 2026-07-01: Fixed Ubuntu unit name mismatch on kaburuaibox (sshd.service → ssh.service), added LAN whitelist