boban
/
clusev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

docs: mark fail2ban/UFW detection bug resolved (221e49f) 

The detection false-negative was already fixed in the working tree; it is now
committed on feat/v1-foundation with a passing unit test, Pint clean, Codex
clean. Update the handoff so the next session sees it as resolved rather than
open. Notes the still-pending items (live acceptance check on 10.10.90.162; no
version bump/tag/push yet) and that the prior task chip is now stale.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat/v1-foundation
boban 2026-06-14 09:23:15 +02:00
parent 221e49f24a
commit 9c3094cc9a
1 changed files with 25 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
docs/session-handoff.md
View File

@ -22,28 +22,36 @@ original foundational decisions doc (do not overwrite it).
---
## 2. OPEN BUG (priority) — fail2ban & UFW falsely shown "nicht installiert"
## 2. RESOLVED — fail2ban & UFW falsely shown "nicht installiert" (fixed `221e49f`)
**Symptom:** the Hardening checklist shows `fail2ban` and `Firewall (UFW)` as **OFFEN ·
nicht installiert**, while the fail2ban-Status panel below shows `aktiv · 14 gesperrt` with
**Was:** the Hardening checklist showed `fail2ban` and `Firewall (UFW)` as **OFFEN ·
nicht installiert**, while the fail2ban-Status panel below showed `aktiv · 14 gesperrt` with
real SSH-scanner bans. Contradiction.
**Root cause — two different detection methods (same host):**
- `HardeningService` (checklist): installed = `dpkg -l <pkg> | grep -q '^ii'`
(`PackageManager::isInstalledTest`, apt) / `FirewallTool::installedTest()` for ufw; active =
`systemctl is-active`. → asks "is the **apt package** recorded?"
- `Fail2banService::status` (panel): installed = `command -v fail2ban-client`; active =
`systemctl is-active`; jails via `fail2ban-client status`. → asks "is the **binary present +
service running**?"
- The host is Debian/apt and fail2ban is genuinely running (14 real bans), but dpkg does not
list it as `^ii` → checklist false-negative. Same for ufw.
- `HardeningService::state` (checklist): installed = `dpkg -l <pkg> | grep -q '^ii'` /
`rpm -q`; active = `systemctl is-active`. → asked "is the **apt/rpm package** recorded?"
- `Fail2banService::status` + `FirewallTool` (panels): installed = `command -v <client>`;
active = `systemctl is-active`. → asked "is the **binary present + service running**?"
- The host is Debian/apt and fail2ban/ufw is genuinely running, but dpkg does not list it as
`^ii` (source install, or dpkg `rc` config-only state) → checklist false-negative.
**Fix direction:** make the checklist's "installed" = (apt `ii`) OR (`command -v` binary
present) OR (service active) — align with `Fail2banService`. Touch:
`app/Services/HardeningService.php` (~lines 50–66, the `$cmd` probe),
`app/Support/Os/PackageManager.php::isInstalledTest`,
`app/Support/Os/FirewallTool.php::installedTest`. Verify on 10.10.90.162 how fail2ban/ufw are
actually installed (apt vs source vs `rc` config-only). A task chip was spawned for this.
**Fix (committed on `feat/v1-foundation`, NOT yet tagged/pushed):** the checklist's installed
probe in `app/Services/HardeningService.php::state` now ORs three conditions —
package-manager test (`dpkg ^ii` / `rpm -q`) **OR** client binary on PATH (`command -v`)
**OR** service active (`systemctl is-active`) — via the local `$anyOf()` helper, for **both**
fail2ban and the firewall (ufw/firewalld). Consistent with `Fail2banService::status`. Since a
component can never be active without being installed, this only removes FALSE negatives,
never adds a false-positive. `PackageManager`/`FirewallTool` were left unchanged (the OR is
composed in `HardeningService`, not in their primitives).
Verified: new unit test `tests/Feature/HardeningServiceTest.php` (Debian/apt source-install
fallback) **passes**; Pint clean; Codex review clean (no actionable regression).
**Still pending (deferred this session):** (a) live acceptance check against fleet host
10.10.90.162 — load Server-Details and confirm fail2ban/ufw now read "installiert"; (b) no
version bump / CHANGELOG / tag / push — the fix lives on the branch only. The prior session's
"Fix fail2ban/UFW false negative" task chip is now **stale** (work is done).
---