V8.00.000.2025.06.17

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

func/cdi_4400_hardening/4420_hardening_fail2ban.sh

@@ -63,7 +63,13 @@ EOF
     cat << EOF >> "${var_target}/etc/fail2ban/jail.d/ciss-default.conf"
 [DEFAULT]
 usedns    = yes
-ignoreip  = 127.0.0.0/8 ::1
+# 127.0.0.1/8  – IPv4 loopback range (local host)
+# ::1/128      – IPv6 loopback
+# fe80::/10    – IPv6 link-local (on-link only; NDP/RA/DAD)
+# fc00::/7     – IPv6 ULA (private LAN addresses)
+# ff00::/8     – IPv6 multicast (not an unicast host)
+# ::/128       – IPv6 unspecified (all zeros; never a real peer)
+ignoreip  = 127.0.0.1/8 ::1/128 fe80::/10 fc00::/7 ff00::/8 ::/128
 # ${VAR_FINAL_FQDN}
   ${VAR_FINAL_IPV4}
 EOF

func/cdi_4900_xtended/4950_final_logrotate.sh

@@ -36,6 +36,7 @@ final_logrotate() {
     "fail2ban"
     "rkhunter"
     "rsnapshot"
+    "rsyslog"
     "ufw"
     "unattended-upgrades"
     "usbguard"