Fail2ban for Nginx: trustworthy logs, scoped bans and recovery

Fresh-host precondition: Fail2ban is not installed and no fail2ban.service mask exists. Masking before installation prevents maintainer scripts from starting a package-enabled SSH jail. This mask belongs to this lab procedure and will be removed only after configuration review. Do not mask an existing security service. The commands do not start or enable nftables.service or load a firewall ruleset. Ubuntu may require its official Universe component; if no candidate exists, enable that component through the documented OS repository procedure, not a foreign release.

set -e
sudo systemctl mask fail2ban.service
sudo apt-get update
apt-cache policy fail2ban nginx nftables
sudo apt-get install --no-install-recommends fail2ban nftables python3 nano
fail2ban-client --version
nginx -v
dpkg-query -W fail2ban nginx nftables
sudo systemctl is-enabled fail2ban.service || true

Create the new private lab directory only if absent. Store a private Nginx configuration snapshot before editing; it may contain credential references or secrets. Do not upload it. The scratch directory is not an off-host backup. Keep a note of the exact virtual-host file and location you will change; recovery restores only those affected files, not the whole snapshot over concurrent edits.

set -e
test ! -e "/srv/academy-fail2ban-lab"
test ! -L "/srv/academy-fail2ban-lab"
sudo install -d -m 0700 "/srv/academy-fail2ban-lab"
sudo tar -C /etc -cpf "/srv/academy-fail2ban-lab/nginx-before.tar" nginx
sudo chmod 0600 "/srv/academy-fail2ban-lab/nginx-before.tar"
sudo tar -tf "/srv/academy-fail2ban-lab/nginx-before.tar"

Save this complete file at HTTP context. $time_iso8601 includes a numeric offset; the filter below consumes exactly that date format. Keep the f2b marker and field order unchanged unless you also revise and retest the filter and fixtures.

log_format academy_auth '$time_iso8601 f2b $remote_addr $status';

Open the exact existing virtual-host file identified by preflight in your protected editor. Add only the access_log line below inside its already working Basic-auth location; retain its auth_basic/auth_basic_user_file, TLS, content handler, routing and other access logs. This is a one-line fragment, not a replacement virtual host. Adding an access_log at a location overrides inherited access logs: explicitly retain any inherited audit log you still require at that location.

Do not log an entire API whose ordinary challenges are 401. Select the real authentication boundary, review location precedence/internal redirects and confirm missing credentials give 401 there. This tutorial neither creates a password file nor collects its secret in browser settings. Keep password/hash files in your existing protected editor and access-control process.

access_log /var/log/nginx/academy-auth.log academy_auth;

This reload belongs only on your dedicated lab after its before-state is saved. A failed syntax test must prevent reload. Do not change ownership of the whole log directory or make logs world-writable. The Nginx master should create this standard-directory log; inspect its actual owner/mode. Existing logrotate rules must include the chosen .log path and reopen Nginx logs after rotation.

set -e
sudo nginx -t && sudo systemctl reload nginx
sudo stat -c "%U:%G %a %n" "/var/log/nginx/academy-auth.log"
sudo cat /etc/logrotate.d/nginx