MajorLinux
9e96ebb110
Documents the gotcha discovered during the 2026-04-30 DCAProd XML-RPC
outage triage: wp-fail2ban plugin emits via PHP syslog(LOG_AUTH) which
lands in /var/log/auth.log on Debian/Ubuntu, not /var/log/syslog.
wordpress-{hard,soft,extra} jails configured with logpath=/var/log/syslog
(common in tutorials and ansible roles) silently catch zero events.
Article includes diagnostic steps, the fix, fail2ban-regex verification,
distro cheat sheet (Debian/Ubuntu vs RHEL/Fedora vs systemd-journal-only),
and a note on why wordpress-login is unaffected.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
10 KiB
10 KiB
| created | updated |
|---|---|
| 2026-04-02T16:03 | 2026-04-29T22:45 |
- Home
- Linux & Sysadmin
- Linux File Permissions
- Managing Linux Services with systemd
- SSH Config & Key Management
- Package Management Reference
- Ansible Getting Started
- Bash Scripting Patterns
- SnapRAID & MergerFS Storage Setup
- mdadm — Rebuilding a RAID Array After Reinstall
- Linux Distro Guide for Beginners
- WSL2 Instance Migration to Fedora 43
- WSL2 Training Environment Rebuild
- WSL2 Backup via PowerShell
- Self-Hosting & Homelab
- Self-Hosting Starter Guide
- Docker vs VMs for the Homelab
- Debugging Broken Docker Containers
- Docker Healthchecks
- Watchtower SMTP via Localhost Postfix Relay
- Setting Up Caddy as a Reverse Proxy
- Tailscale for Homelab Remote Access
- Network Overview
- Wake-on-LAN via Router SSH
- Pi-hole v6 Group Management — Per-Client DNS Rules
- AWS S3 Cost Management
- rsync Backup Patterns
- Tuning Netdata Web Log Alerts
- Tuning Netdata Docker Health Alarms
- Deploying Netdata to a New Server
- Netdata SELinux AVC Denial Monitoring
- Netdata n8n Enriched Alert Emails
- Updating n8n Running in Docker
- Mastodon Instance Tuning
- Ghost Email Configuration with Mailgun
- Claude Code Remote Control — Mobile Access to a Persistent Host Session
- Linux Server Hardening Checklist
- Standardizing unattended-upgrades with Ansible
- Fail2ban Custom Jail: Apache 404 Scanner Detection
- Fail2ban Custom Jail: Apache PHP Webshell Probe Detection
- Fail2ban Custom Jail: WordPress Login Brute Force
- wp-fail2ban Plugin Logpath on Debian/Ubuntu (auth.log not syslog)
- SELinux: Fixing Fail2ban grep execmem Denial
- UFW Firewall Management
- Firewall Hardening with firewalld on Fedora Fleet
- Fail2ban Custom Jail: Nginx Bad Request Detection
- Fail2ban Custom Jail: Apache Bad Request Detection
- SSH Hardening Fleet-Wide with Ansible
- ClamAV Fleet Deployment with Ansible
- Open Source & Alternatives
- SearXNG: Private Self-Hosted Search
- FreshRSS: Self-Hosted RSS Reader
- Gitea: Self-Hosted Git
- rmlint: Duplicate File Scanning
- tmux: Persistent Terminal Sessions
- screen: Simple Persistent Sessions
- rsync: Fast, Resumable File Transfers
- Ventoy: Multi-Boot USB Tool
- Vaultwarden: Self-Hosted Password Manager
- yt-dlp: Video Downloading
- Streaming & Podcasting
- Troubleshooting
- Apache Outage: Fail2ban Self-Ban + Missing iptables Rules
- Mail Client Stops Receiving: Fail2ban IMAP Self-Ban
- firewalld: Mail Ports Wiped After Reload
- Tailscale SSH: Unexpected Re-Authentication Prompt
- Fail2ban & UFW Rule Bloat Cleanup
- Custom Fail2ban Jail: Apache Directory Scanning
- Nextcloud AIO Unhealthy 20h After Nightly Update
- n8n Behind Reverse Proxy: X-Forwarded-For Trust Fix
- Docker & Caddy Recovery After Reboot (Fedora + SELinux)
- ISP SNI Filtering with Caddy
- Obsidian Vault Recovery — Loading Cache Hang
- Qwen2.5-14B OOM on RTX 3080 Ti (12GB)
- yt-dlp YouTube JS Challenge Fix on Fedora
- Gemini CLI Manual Update
- MajorWiki Setup & Publishing Pipeline
- Gitea Actions Runner: Boot Race Condition Fix
- Cron Heartbeat False Alarm: /var/run Cleared by Reboot
- SELinux: Fixing Dovecot Mail Spool Context (/var/vmail)
- mdadm RAID Recovery After USB Hub Disconnect
- Windows OpenSSH Server (sshd) Stops After Reboot
- Windows OpenSSH: WSL Default Shell Breaks Remote Commands
- Pi-hole AI Blocklist Blocks Claude Desktop (ERR_CONNECTION_REFUSED)
- Ollama Drops Off Tailscale When Mac Sleeps
- Ollama:
ollama runwith Piped Stdin Bypasses Chat Template + SYSTEM Prompt - rsync over Tailscale: Hung in TCP Teardown After Transfer Completes
- macOS: Repeating Alert Tone from Mirrored iPhone Notification
- ClamAV CPU Spike: Safe Scheduling with nice/ionice
- Ansible: Vault Password File Not Found
- Ansible: ansible.cfg Ignored on WSL2 Windows Mounts
- Ansible: SSH Timeout During dnf upgrade on Fedora Hosts
- Fedora Networking & Kernel Troubleshooting
- Systemd Session Scope Fails at Login
- wget/curl: URLs with Special Characters Fail in Bash
- Ansible: Check Mode False Positives in Verify/Assert Tasks
- Ansible Fails with Permission Denied While
ssh <alias>Works (Host Alias Bypass) - Ghost EmailAnalytics Lag Warning — What It Means and When to Worry
- claude-mem: --setting-sources Empty Arg Bug (Claude Code 2.1.x)