# Fail2Ban4Win INI / Mystic hook test 2

Source: https://github.com/geosone/Fail2Ban4Win/tree/3f96bbb02fc927860c76627b05423db9a2707fbc
Upstream: Aldaviva/Fail2Ban4Win, Apache-2.0. This is a fork test build,
not an official upstream release. Dependencies and their licenses are included
in the MSI. Runtime: .NET Framework 4.7.2+ (tested with Windows 10 22H2 x86/x64).

Build provenance: commit 3f96bbb02fc927860c76627b05423db9a2707fbc, GitHub Actions run 41093590699,
65 passing tests. MSI generated with packaging/windows/New-WindowsMsi.ps1
-TestRevision 2 and finalized using the native Windows Installer API.
The MSI version 1.5.2 denotes fork test revision 2; EXE file version 1.5.0.1.
EXE SHA256: 9be79bd259fd894914c63ad10b191b45518d84520f6437ad5643ce50007afd5f

New in test 2: optional local Mystic IP Blocked hook, protected named-pipe
control, individual IPv4/IPv6 addresses, exact Mystic denylist maintenance,
manual and timed unban, persistent INI retry queue for busy files, and an
UnbanInMystic switch. No additional Mystic log tailer is required.
The PowerShell bridge and qualified A49 DAT configuration tools are in:
https://gitea.disconnected-by-peer.at/geos_one/mysticd/src/branch/installer/powershell-trixie
See docs/native-configuration.md there. The packaged hook remains DISABLED
until explicitly configured. Initial service startup is disabled and
isDryRun=true. No event selectors are configured by default.

Native tests on both VMs passed: installation, quoted service path,
configuration ACL, diagnostic start/stop, repair, uninstall and preserved INI.
Separate real-service tests under SYSTEM passed the PS5-to-PS7 bridge,
control-peer authentication, management-network exemption, firewall plus
Mystic denylist ban/unban and timed expiry, preserving unrelated lines.
NETWORK logon tokens, including the tested SSH session, are denied by the
control-pipe ACL; configure and test the intended local MIS service account.
Windows 7 has NOT been qualified.

Uninstall older test packages before replacing them; automatic upgrades are
not qualified. x86 and x64 packages use the same service name: choose one.
Existing INI files survive uninstall and must be reviewed before activating
a newer build. Do not replace a running production firewall service blindly.
The earlier test1 downloads remain available under their original filenames.