From 1c6fea1352b470c3604df11f4ff4cc74d0b252a7 Mon Sep 17 00:00:00 2001
From: rlei-odes <242280117+rlei-odes@users.noreply.github.com>
Date: Thu, 4 Jun 2026 20:23:10 +0200
Subject: [PATCH] fix: fail2ban jail config for modern Debian and multi-server
 setups

Two related bugs in module_fail2ban():

1. When a web server was detected, both nginx-http-auth and apache-auth
   jails were always added together. On nginx-only systems (e.g. Passbolt)
   the apache-auth jail has no log file to watch, causing fail2ban to crash
   on startup with "Have not found any log file for apache-auth jail".
   Fix: check for each server independently at the point of writing the
   jail, so only installed servers get a jail entry.

2. The sshd jail hardcoded logpath = /var/log/auth.log, which does not
   exist on Debian 12+/13 (Trixie) where systemd-journald handles logging
   without writing syslog files. fail2ban crashed silently on these systems.
   Fix: replace logpath with backend = systemd so the sshd jail reads
   directly from the journal, which is correct on modern Debian/Ubuntu.
---
 fortress_improved.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fortress_improved.sh b/fortress_improved.sh
index 346891c..f7c265e 100644
--- a/fortress_improved.sh
+++ b/fortress_improved.sh
@@ -1303,7 +1303,7 @@ module_fail2ban() {
     local has_web_server=false
     local has_mail_server=false
     local ssh_has_password_auth=true
-    
+
     command -v apache2 &>/dev/null && has_web_server=true
     command -v nginx &>/dev/null && has_web_server=true
     command -v postfix &>/dev/null && has_mail_server=true
@@ -1366,10 +1366,10 @@ action = ${f2b_action}
 [sshd]
 enabled = ${ssh_has_password_auth}
 port = ssh
-logpath = /var/log/auth.log
+backend = systemd
 EOF
 
-        if [[ "${has_web_server}" == "true" ]]; then
+        if command -v nginx &>/dev/null; then
             ${SUDO} tee -a /etc/fail2ban/jail.local > /dev/null << 'EOF'
 
 [nginx-http-auth]
@@ -1377,6 +1377,11 @@ enabled = true
 filter = nginx-http-auth
 port = http,https
 logpath = /var/log/nginx/error.log
+EOF
+        fi
+
+        if command -v apache2 &>/dev/null; then
+            ${SUDO} tee -a /etc/fail2ban/jail.local > /dev/null << 'EOF'
 
 [apache-auth]
 enabled = true