3 Commits

Include renames

Author	SHA1	Message	Date
jochen	c78d0a0134	fail2ban: know the own-addresses list in the form fail2ban prints it (hq issue 238) ... fail2ban reads the ignoreip entry file:/var/lib/... and prints it back as file://var/lib/..., in get <jail> ignoreip and in its "Ignore ... by ..." log lines alike. The watch compared the text, so on ace it said every jail lacked the list while each held it, failing fail2ban's health and its walk; and it would never have counted a failure from the operator's own address. Compare the path instead, with a test on fail2ban's real form.	2026-10-13 11:14:24 +02:00
jochen	93d58f3740	fail2ban: never ban the operator's own addresses, and say a failure from one (hq issue 238, ADR 0339) ... An agent polling the forge from the operator's home got that home banned for a day and then four weeks, and nothing in the house reached the control-node. Every jail spared only private ranges. The mesh-wide setting own-addresses reaches the machine as a mergeable file whose own content is the empty list, so the module composes while it is unset. A new watch process (root) writes its entries into a list every jail's base ignoreip names as file:, which fail2ban reloads without a restart; it checks every jail names that list and keeps each failure a jail ignored because of it for a day. The new fail2ban_health tool judges the watch, so the controller raises a warning naming node, jail, address and count. The ban verb refuses an address on the setting or on the jail's ignore list before the daemon is asked.	2026-10-13 10:54:49 +02:00
jschoubben	d43de93e49	fail2ban: its tools in Go ... Go is the default for module code. One binary, fail2ban-tools, serving the node-intrusion-prevention seat's four verbs and fail2ban_settings over the SDK, with the same parsing and the same tests; read back against the control node's live daemon.	2026-10-05 12:01:25 +02:00