From 118a2efe9ab02174e4882bb4616d11a1d974cb87 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Sat, 14 Feb 2026 02:41:43 +0800
Subject: [PATCH] Make fail2ban hardening robust on fresh servers

---
 scripts/security/harden-server.sh | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/scripts/security/harden-server.sh b/scripts/security/harden-server.sh
index 4a10203d3..719ab700f 100755
--- a/scripts/security/harden-server.sh
+++ b/scripts/security/harden-server.sh
@@ -228,8 +228,13 @@ configure_fail2ban() {
     return
   fi
 
+  local nginx_jail_enabled="false"
+  if [ -f /var/log/nginx/access.log ] || [ -f /var/log/nginx/error.log ]; then
+    nginx_jail_enabled="true"
+  fi
+
   mkdir -p "$(dirname "$FAIL2BAN_JAIL_FILE")"
-  cat > "$FAIL2BAN_JAIL_FILE" << 'EOF'
+  cat > "$FAIL2BAN_JAIL_FILE" << EOF
 [DEFAULT]
 bantime = 1h
 findtime = 10m
@@ -242,18 +247,25 @@ ignoreip = 127.0.0.1/8 ::1
 
 [sshd]
 enabled = true
-mode = aggressive
+backend = systemd
+journalmatch = _COMM=sshd
+mode = normal
 
 [nginx-http-auth]
-enabled = true
+enabled = ${nginx_jail_enabled}
 
 [nginx-botsearch]
-enabled = true
+enabled = ${nginx_jail_enabled}
 EOF
 
   systemctl enable fail2ban >/dev/null 2>&1 || true
   systemctl restart fail2ban >/dev/null 2>&1 || true
-  log "fail2ban configured"
+
+  if systemctl is-active --quiet fail2ban; then
+    log "fail2ban configured"
+  else
+    log "fail2ban failed to start, check: journalctl -u fail2ban -n 100 --no-pager"
+  fi
 }
 
 configure_sysctl() {