I'll mention this again, if you're git-blaming this, don't come slap me personally. This code straight ported from another project and we WILL refactor this in the future. This is a temporary solution. OK I guess you can slap me for porting this as is, but still.

harden

@@ -387,10 +387,10 @@ EOF
 printf "%s" "$FAIL2BAN_LOCAL" | sudo tee /etc/fail2ban/fail2ban.local
 FAIL2BAN_SSH_JAIL_LOCAL=$(cat <<'EOF'
 [sshd]
+backend = systemd
 enabled = true
 filter = sshd
 banaction = ufw
-backend = systemd
 maxretry = 3
 # 3 failed attempts in 600 seconds = 10 minutes
 findtime = 1d
@@ -400,6 +400,7 @@ EOF
 )
 FAIL2BAN_JAIL_LOCAL=$(cat <<'EOF'
 [DEFAULT]
+backend = systemd
 bantime = 1d
 EOF
 )