core.autocrlf=true is set for this Windows checkout, so the scripts were
previously checked out with CRLF, which breaks a shebang and heredocs when
a script is run on Linux or from WSL. Pin eol=lf for *.sh.
Default profile bans 3 failures in 10 minutes for 24 hours, with repeat
offenders (3 bans in a day) banned for a week. The sshd jail reads the
journal, the recidive jail reads fail2ban's own log file.
The recidive jail can only count bans in a file, so the script resolves
the effective logtarget from fail2ban.conf, fail2ban.d/*.conf and
fail2ban.local, refuses a non-file target, and verifies the file really
receives output before reporting success.
ecss