sshd: enable fail2ban with default ssh jail (quick win, no exposure change) #104

New issue

Open

opened 2026-05-24 18:27:07 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-24 18:27:07 +00:00

Owner

Problem

fail2ban and sshguard are both inactive on kai-server while sshd is listening on 0.0.0.0:22 and auth.log is taking active brute-force scans (2.57.122.177, 89.134.210.182, 213.35.128.24, 161.35.139.3, etc., observed live during today's mobile-SSH debug). Nothing is throttling repeated failed-auth attempts.

Proposed change

Lowest-risk immediate hardening that doesn't depend on resolving the broader exposure question:

sudo apt install fail2ban
sudo systemctl enable --now fail2ban

Default jail config ships with the sshd jail enabled and tuned for Ubuntu's auth.log format. No sshd binding changes, no firewall topology changes - just bans IPs after N failed-auth attempts.

Verify after:

sudo fail2ban-client status
sudo fail2ban-client status sshd

Why split this off from the bigger audit

The parent issue, infrastructure#103, needs decisions about router port-forwards and the tangled-knot git-SSH path before changing exposure. That's a real audit. fail2ban can ship in 5 minutes regardless of those decisions and immediately cuts bot scan effectiveness.

Parent

infrastructure#103 - umbrella security pass on sshd public exposure.

Filed by Claude.

**Problem** `fail2ban` and `sshguard` are both `inactive` on kai-server while sshd is listening on `0.0.0.0:22` and `auth.log` is taking active brute-force scans (`2.57.122.177`, `89.134.210.182`, `213.35.128.24`, `161.35.139.3`, etc., observed live during today's mobile-SSH debug). Nothing is throttling repeated failed-auth attempts. **Proposed change** Lowest-risk immediate hardening that doesn't depend on resolving the broader exposure question: ``` sudo apt install fail2ban sudo systemctl enable --now fail2ban ``` Default jail config ships with the `sshd` jail enabled and tuned for Ubuntu's auth.log format. No sshd binding changes, no firewall topology changes - just bans IPs after N failed-auth attempts. Verify after: ``` sudo fail2ban-client status sudo fail2ban-client status sshd ``` **Why split this off from the bigger audit** The parent issue, [infrastructure#103](https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/103), needs decisions about router port-forwards and the tangled-knot git-SSH path before changing exposure. That's a real audit. fail2ban can ship in 5 minutes regardless of those decisions and immediately cuts bot scan effectiveness. **Parent** - [infrastructure#103](https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/103) - umbrella security pass on sshd public exposure. **Filed by Claude.**

coilysiren referenced this issue

2026-05-24 18:47:51 +00:00

Tailscale Android: per-app routing to Termux cycles up/down on ~10-min interval #105

coilysiren referenced this issue

2026-05-24 18:52:31 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106

coilysiren referenced this issue

2026-05-24 20:00:26 +00:00

Home 5GHz WiFi: Tailscale tunnel cycles up/down on ~2-5 min intervals from this network only #106

coilysiren added the

label

2026-05-31 01:54:37 +00:00