[grojof]

Second audit, group E: operations. Each fix is checked by running it against real fail2ban, nginx and logrotate.

• fail2ban
  • Web and Odoo bans now use the tool's own ufw-odoo-web action, which blocks only ports 80 and 443.
    • On 0.11.2 (Ubuntu 22.04, Debian 11), fail2ban's own ufw[application="Nginx Full"] split the profile name, and ufw refused every ban. A negative control reproduces this.
    • Checked on 0.11.2, 1.0.2 and 1.1.0: each version's rendered ban runs against a stub ufw.
  • backend is set per jail. Where auth.log is absent (Debian 12), sshd reads the journal.
  • Durations and the ignore list are validated, and the admin's SSH address is proposed for the ignore list.
  • The regex test no longer writes the filter.
• Staged writes (fail2ban, logrotate, nginx): every file is backed up first and each write is checked. A failed write or INT/TERM restores the previous configuration. All three failure modes were run.
• Certificates
  • Let's Encrypt uses /etc/letsencrypt/live/<domain>/.
  • "Leave certificates untouched" keeps the files the current vhost names, including certbot's.
  • Missing files or a cancelled file pick write no HTTPS vhost.
  • nginx -t accepts these vhosts, also when written for an unknown nginx version.
• Update configuration: sets the role password, checks the login with the new values, then writes and restarts. With a new password for a remote role it does not restart. The backup path is shown even on failure.
• UFW: enabling allows SSH first, deleting the SSH rule asks for confirmation, and the PostgreSQL source must be a single address.
• logrotate: the policy is staged and validated with logrotate -d, and the size is validated.

CI gets Python 3.9 and 3.11 to run the older fail2ban releases.

OpenSpec: 2026-10-08-ops-hardening-2.

Assisted-by: Claude