NetworkCatsandClaude Opus 5.5 b8c5a7439c Fix fail2ban and disable SSH password logins ...

fs.nr_open = 65536 sat below systemd's default hard NOFILE limit
(524288), so any service without its own LimitNOFILE failed to restart
once the sysctl was applied (205/LIMITS); fail2ban was down after the
last deploy, and after a reboot ssh could be too. Leave nr_open at the
kernel default.

fail2ban also read /var/log/auth.log, which Debian 13 no longer
writes; read sshd's journal instead.

Disable password and keyboard-interactive SSH logins and allow root
with keys only. The drop-in is named 10-* so it wins over cloud-init's
50-cloud-init.conf, which turns password logins on.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-22 21:58:38 +08:00

..

ansible

Fix fail2ban and disable SSH password logins

2026-10-22 21:58:38 +08:00

terraform

Restrict HTTPS to Cloudflare with UFW on the host

2026-10-22 21:13:48 +08:00

INSTALL.md

Restrict HTTPS to Cloudflare with UFW on the host

2026-10-22 21:13:48 +08:00

NOTE.txt

add note

2026-03-06 21:10:32 +08:00