Hi again, 
doing some more research on the matter seems to get me even more confused. 
Here I saw the topic “How to Install Fail2ban with Firewalld on Rocky Linux 8” is discussed.
Apparently running fail2ban and systemd isn´t mutually exclusive after all. 
Fail2Ban will automatically block the IP address using the iptables of Firewalld
and…
(tutorial):
- First, rename the Firewalld configuration file for Fail2Ban using the following command:
mv /etc/fail2ban/jail.d/00-firewalld.conf /etc/fail2ban/jail.d/00-firewalld.local
- Next, edit the jail.local file:
Here comes the crucial part:
Find the following lines:
banaction = iptables-multiport
banaction_allports = iptables-allports
And replace them with the following lines:
banaction = firewallcmd-rich-rules[actiontype=]
banaction_allports = firewallcmd-rich-rules[actiontype=]
Save and close the file, then restart the Fail2Ban to apply the changes:
systemctl restart fail2ban
The rest should be clear, I think:
Find the [sshd] section and enable it by adding the following lines:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
bantime = 10m
findtime = 10m
maxretry = 5
systemctl restart fail2ban
O.K, according to this tutorial fail2ban should work well together with a running firewall, firewalld in my case.
What should I believe now 
Issue or nor issue?
@kovacslt:
How´s the situation with your machine, if I may ask?
Do you have a firewall running along with fail2ban
Many thanks in advance …
… and cheers from Rosika 
P.S.:
Hi all,
Update:
In the meantime I discussed the “problem” with ChatGPT.
Seems running fail2ban together with firewalld should be no issue at all.
Atlantic Tutorial:
- This tutorial provides instructions for configuring Fail2ban to work with firewalld on Rocky Linux 8. It suggests renaming the Fail2ban configuration file for firewalld and modifying the banaction settings in the Fail2ban configuration to use firewallcmd-rich-rules.
- The tutorial demonstrates that it’s possible to use Fail2ban alongside firewalld by making the appropriate configuration changes.
In summary, while there might be some ambiguity or lack of documentation regarding using Fail2ban with firewalld, it is indeed possible to configure them to work together effectively. The Atlantic tutorial demonstrates one approach to achieve this on Rocky Linux 8.
You can proceed with configuring Fail2ban to work alongside firewalld on your Linux Lite 6.2 system. Follow the steps provided in the tutorial, adapt them as necessary for your distribution, and test to ensure that Fail2ban is effectively banning malicious IP addresses while working alongside firewalld.
These were the relavant steps:
1a.)
sudo apt update
sudo apt install fail2ban
1b.)
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
2.)
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
3.)
sudo nano /etc/fail2ban/jail.local
Here:
4.)
Find the [sshd] section and ensure that it is enabled and configured as follows:
[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
bantime = 10m
findtime = 10m
maxretry = 5
5.)
Find the following lines:
banaction = iptables-multiport
banaction_allports = iptables-all
and replace them with the following lines:
banaction = firewallcmd-ipset
banaction_allports = firewallcmd-ipset
6.)
sudo systemctl restart fail2ban
sudo systemctl restart firewalld
O.K., everything appears to be working alright:
rosika@rosika-Lenovo-H520e ~> systemctl status fail2ban
● fail2ban.service - Fail2Ban Service
Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor pres>
Active: active (running) since Wed 2024-04-24 15:37:26 CEST; 20s ago
Docs: man:fail2ban(1)
Main PID: 29361 (fail2ban-server)
Tasks: 5 (limit: 4431)
Memory: 12.2M
CPU: 197ms
CGroup: /system.slice/fail2ban.service
└─29361 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
Apr 24 15:37:26 rosika-Lenovo-H520e systemd[1]: Started Fail2Ban Service.
Apr 24 15:37:26 rosika-Lenovo-H520e fail2ban-server[29361]: Server ready
rosika@rosika-Lenovo-H520e ~> sudo fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: sshd
rosika@rosika-Lenovo-H520e ~> sudo fail2ban-client status sshd
Status for the jail: sshd
|- Filter
| |- Currently failed: 0
| |- Total failed: 0
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
Many greetings to all of you.
Rosika
