Repository navigation
root-ubuntu: size-capped log rotation, fail2ban, quiet networkd-dispatcher - #107
Merged
Merged
Conversation
…tcher configure_logrotate: nginx logs rotate daily or past LOGROTATE_MAXSIZE (200M), 14 kept, and logrotate.timer goes hourly so the cap is checked. dev2 had a 1.2 GB and a 516 MB access log after two days. configure_fail2ban: sshd jail layered on Ubuntu's defaults, bans double on each repeat (1h up to 1w), ignoreip = loopback, the tailnet, the operator's FAIL2BAN_IGNOREIP and whoever is connected over ssh while it runs. Reads auth.log, or the journal on a box without rsyslog. quiet_networkd_dispatcher: with Docker, every container stop makes the dispatcher run networkctl on a veth that is already gone and log an error: 3,895 in six hours on dev2. Stopped only when it has no hooks. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
ThreatCrush Security Scan25 finding(s) HIGH/CRITICAL: 4 | MEDIUM: 12 | LOW: 9
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three additions to
root-ubuntu.sh. Each one is idempotent, has its own*_ENABLE-style switch, and only restarts a service when something actually changed. They run right after the OOM section.configure_logrotate. On dev2 today,supabase-crawlproof.access.logwas 1.2 GB andaccess.log516 MB after two days, because stock nginx rotation is daily-only and logrotate runs once a day./etc/logrotate.d/nginxstanza withmaxsize $LOGROTATE_MAXSIZE(200M) androtate $LOGROTATE_KEEP(14). It can't be a drop-in: logrotate rejects a second stanza for the same files ("duplicate log entry").logrotate.timer.d/hourly.conf, somaxsizeis checked every hour. Small logs still rotate daily.logrotate -d /etc/logrotate.confand warns loudly if any config on the box is broken, since one bad stanza stops all rotation.configure_fail2ban.jail.d/zz-root-ubuntu.localon top of Ubuntu'sdefaults-debian.conf: sshd on$SSH_PORT,bantime.increment = true(1h, doubling up to 1w),findtime 10m,maxretry 5.ignoreipis loopback,100.64.0.0/10(the tailnet),FAIL2BAN_IGNOREIP(your admin boxes, from server.conf or env; this public script hardcodes no IPs), and every peer connected to sshd while it runs, so it can't lock out the operator.auth.logwhere rsyslog writes one. Otherwise it usesbackend = systemdand installspython3-systemd.quiet_networkd_dispatcher. With Docker, every container stop deletes a veth, and networkd-dispatcher then runsnetworkctl statuson it after it's gone and logsERROR:Failed to get interface … not found. That was 3,895 err-priority journal lines in 6h on dev2, which ThreatCrush shows as HIGH. dev2's dispatcher has no hook scripts at all, so it does nothing else. The function stops it only when no hook exists anywhere, and keeps it otherwise (NETWORKD_DISPATCHER_QUIET=0to never touch it).Tests. 14 new, in the file's existing style: functions extracted and run in real bash with a temp directory standing in for
/etc, and systemctl/apt/dpkg stubbed.logrotate -d.ENABLE=0really means off.ignoreiphas the expected order and is deduplicated, SSH peers included.SSH_PORThonoured, no restart when already correct.Full suite 1,289/1,289.
bash -nand shellcheck are clean on the new code.🤖 Generated with Claude Code