feat(security): fail2ban sshd.local с ignoreip admin и banaction ufw.

docs/security/haproxy-host.md

@@ -104,6 +104,8 @@ sudo fail2ban-client status haproxy-reject
 
 Порог: **15** reject за **10 мин** → бан **24 ч** через UFW. `ignoreip`: LAN, VPN, admin.
 
+**sshd:** `jail.d/sshd.local` — `banaction = ufw`, те же `ignoreip` (не банить admin/VPN/LAN).
+
 После `systemctl restart fail2ban` подождите 1–2 с перед `fail2ban-client status` (сокет).
 
 ### SSH (пример)

scripts/security/fail2ban-install.sh

@@ -29,6 +29,7 @@ command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt i
 install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
 install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
 install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
+install -m 0644 "$F2B_DIR/sshd.local" /etc/fail2ban/jail.d/sshd.local
 
 log "fail2ban-regex haproxy-json-reject"
 fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
@@ -44,4 +45,5 @@ systemctl restart fail2ban
 sleep 1
 fail2ban-client status
 fail2ban-client status haproxy-reject
+fail2ban-client status sshd
 log "done"

scripts/security/fail2ban/sshd.local

@@ -0,0 +1,4 @@
+[sshd]
+enabled = true
+banaction = ufw
+ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121