Documentation
Install, configure, migrate, and operate fail2zig. v0.4.7 is the minimum supported release; use v0.4.8 for new installs and upgrades. A v0.4.6 state upgrades through v0.4.7 first. Earlier releases are retired and are not supported installation or rollback targets.
Getting Started
- Example jail configuration A 0.4.8 configuration for Debian SSH journal input, confirmed-ban recidive and an optional file jail.
- Migrating from fail2ban Inspect supported configuration, transfer schema-4 SQLite state and plan continuity, cutover and rollback with fail2zig 0.4.8.
- Upgrading to 0.4.8 Reach the current release from v0.4.7, or from a v0.4.6 state through v0.4.7 first, with the schema 26 backup, the new defaults and the changed stop semantics.
- Log file lifecycle How a file source records its position and what happens on rotation, truncation, replacement and a missing log, with the on_truncation policy and repair-source.
- PortSentry scan detection Configure the qualified PortSentry v2.0.7 history-file recipe, in connect or stealth mode, with fail2zig 0.4.8.
- Verifying a release build Check 0.4.8 artifact integrity, static linkage, dependencies and host enforcement without assuming universal support.
Reference
- Configuration reference Native TOML settings, durations, timed entries, sources, storage, enforcement and reload boundaries for fail2zig 0.4.8.
- Filters and native rules Built-in service matchers, PortSentry history input and bounded native JSON rules for fail2zig 0.4.8.
- fail2zig — daemon and offline commands Run, validate, test rules, repair sources, collect support bundles and prepare migrations with the unified 0.4.8 executable.
- fail2zig — administration Status, ban origins, runtime exclusions, firewall observation and withdrawal, online source repair, support bundles and jail controls in 0.4.8.
Architecture
- Runtime dependencies The static executable, embedded SQLite C and host tools required by each input and firewall path.
- Memory and durable resource limits How native admission, bounded storage and recovery preserve protection under resource pressure.
- Log watching and continuity File identity, durable checkpoints, journal origins and the confirmed-ban recidive source.
- Parser and native rules Compiled service matchers, bounded JSON rules, offline evaluation and typed detection results.
- Firewall enforcement Typed intent, backend selection, owned-kernel readback and retained firewall observation in 0.4.8.
- Trusted computing base Application code, embedded SQLite, kernel interfaces, host tools and the service privilege boundary.