NetworkCatsandClaude Opus 5.5 b8c5a7439c Fix fail2ban and disable SSH password logins ...

fs.nr_open = 65536 sat below systemd's default hard NOFILE limit
(524288), so any service without its own LimitNOFILE failed to restart
once the sysctl was applied (205/LIMITS); fail2ban was down after the
last deploy, and after a reboot ssh could be too. Leave nr_open at the
kernel default.

fail2ban also read /var/log/auth.log, which Debian 13 no longer
writes; read sshd's journal instead.

Disable password and keyboard-interactive SSH logins and allow root
with keys only. The drop-in is named 10-* so it wins over cloud-init's
50-cloud-init.conf, which turns password logins on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 21:58:38 +08:00

..

handlers

Fix fail2ban and disable SSH password logins

2026-10-22 21:58:38 +08:00

tasks

Fix fail2ban and disable SSH password logins

2026-10-22 21:58:38 +08:00

templates

Fix fail2ban and disable SSH password logins

2026-10-22 21:58:38 +08:00