V8.13.224.2025.10.19

Signed-off-by: Marc S. Weidner <msw@coresecret.dev>

config/hooks/live/9950_fail2ban_hardening.chroot

@@ -38,8 +38,13 @@ cat << 'EOF' >| /etc/fail2ban/jail.d/ciss-default.conf
 
 [DEFAULT]
 usedns    = yes
-# local | vpn
-ignoreip  = 127.0.0.0/8 ::1 MUST_BE_SET
+# 127.0.0.1/8  – IPv4 loopback range (local host)
+# ::1/128      – IPv6 loopback
+# fe80::/10    – IPv6 link-local (on-link only; NDP/RA/DAD)
+# fc00::/7     – IPv6 ULA (private LAN addresses)
+# ff00::/8     – IPv6 multicast (not an unicast host)
+# ::/128       – IPv6 unspecified (all zeros; never a real peer)
+ignoreip  = 127.0.0.1/8 ::1/128 fe80::/10 fc00::/7 ff00::/8 ::/128 MUST_BE_SET
 maxretry  = 8
 findtime  = 24h
 bantime   = 24h

config/hooks/live/9999_yyyy_logrotate.chroot

@@ -25,6 +25,7 @@ declare -ar ary_logrotate=(
   "fail2ban"
   "rkhunter"
   "rsnapshot"
+  "rsyslog"
   "ufw"
   "unattended-upgrades"
   "usbguard"