initial transfer

2026-07-27 13:09:00 +02:00
parent 9f25d48dc2
commit 736c01216a
191 changed files with 17622 additions and 136 deletions
@@ -0,0 +1,41 @@
+# armor-fail2ban
+
+**Install and enable fail2ban**
+
+## Purpose
+
+This cube installs and configures Fail2ban, an intrusion prevention software that protects your server from brute-force attacks and unauthorized access attempts.
+
+## What is Fail2ban?
+
+Fail2ban monitors log files (e.g., `/var/log/auth.log`) for suspicious activity, such as repeated failed login attempts. When it detects malicious behavior patterns, it automatically:
+
+- Bans the offending IP address by updating firewall rules
+- Prevents the attacker from making further connection attempts
+- Can send email notifications about bans (if configured)
+
+Common use cases include:
+- Protecting SSH from brute-force password attacks
+- Blocking repeated failed login attempts on web applications
+- Preventing DoS attacks from specific IP addresses
+
+## What This Cube Does
+
+1. Installs the `fail2ban` package via apt
+2. Deploys a custom configuration file (`jail.local`) to `/etc/fail2ban/jail.local`
+3. Configures fail2ban with sensible defaults for common services
+
+## Configuration
+
+This cube currently has no configurable parameters. The default configuration is applied from the included `jail.local` file.
+
+## Dependencies
+
+None - this cube can run standalone.
+
+## Notes
+
+After deployment, you can:
+- Check fail2ban status: `sudo fail2ban-client status`
+- View banned IPs: `sudo fail2ban-client status sshd`
+- Unban an IP: `sudo fail2ban-client set sshd unbanip <IP_ADDRESS>`