feat: add fail2ban setup script with strict ban policy

Default profile bans 3 failures in 10 minutes for 24 hours, with repeat
offenders (3 bans in a day) banned for a week. The sshd jail reads the
journal, the recidive jail reads fail2ban's own log file.

The recidive jail can only count bans in a file, so the script resolves
the effective logtarget from fail2ban.conf, fail2ban.d/*.conf and
fail2ban.local, refuses a non-file target, and verifies the file really
receives output before reporting success.

README.md

@@ -23,3 +23,28 @@ curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/ins
 ```bash
 curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/set-vim-2space.sh | bash
 ```
+
+> **Tip:** Set up fail2ban with a strict profile (3 failures -> 24h ban, repeat offenders -> 1 week).
+
+```bash
+curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/setup-fail2ban.sh | sudo bash
+```
+
+Override the detected SSH port, the sshd filter mode (`normal` by default: `aggressive`
+also counts pre-auth client disconnects as failures, which bans legitimate users) or
+whitelist an extra address:
+
+```bash
+curl -fsSL https://git.vanusys.com/VanuSystems/shell-scripts/raw/branch/main/setup-fail2ban.sh | sudo SSH_PORT=22,2222 IGNORE_IP=198.51.100.0/24 bash
+```
+
+> **Note:** the script whitelists the address of the current session when it can detect it
+> (`SSH_CONNECTION`, `SSH_CLIENT`, or the utmp entry of its terminal). Piped through
+> `curl ... | sudo bash` there is no terminal, so it prints a warning and you should pass
+> `IGNORE_IP=<your address>` yourself — otherwise 3 failed attempts ban you for 24h
+> (and 3 bans for a week).
+
+> **Note:** the script refuses to continue when fail2ban's `logtarget` is not a file
+> (`SYSLOG`, `STDERR`, ...), because the `recidive` jail reads that file to count bans
+> and could otherwise never fire. Set `logtarget = /var/log/fail2ban.log` in
+> `/etc/fail2ban/fail2ban.local` and re-run.