diff --git a/install.sh b/install.sh
index 826217c..b8b4a85 100644
--- a/install.sh
+++ b/install.sh
@@ -37,10 +37,10 @@ DEBIAN_FRONTEND=noninteractive apt-get -y update
 # update grub first, by itself, as it requires special overrides to run unattended
 DEBIAN_FRONTEND=noninteractive apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" install grub-common grub2-common grub-pc grub-pc-bin
 DEBIAN_FRONTEND=noninteractive apt-get -y dist-upgrade
-DEBIAN_FRONTEND=noninteractive apt-get -y autoremove
 
 # remove unwanted packages
 DEBIAN_FRONTEND=noninteractive apt-get -y purge snapd cryptsetup ufw iptables landscape-common popularity-contest
+DEBIAN_FRONTEND=noninteractive apt-get -y autoremove
 ## used to disable apparmor, going to try leaving it in now
 # aa-teardown
 # systemctl stop apparmor
@@ -92,7 +92,8 @@ systemctl restart firewalld
 
 # fail2ban
 DEBIAN_FRONTEND=noninteractive apt-get -y install fail2ban
-chmod 644 fail2ban/*/*
+chmod 644 fail2ban/*.local
+chmod 644 fail2ban/*/*.conf
 cp -a fail2ban/* /etc/fail2ban/
 systemctl enable fail2ban
 systemctl start fail2ban
@@ -106,7 +107,8 @@ sed -i 's|.*MaxRetentionSec=.*|MaxRetentionSec=1week|g' /etc/systemd/journald.co
 systemctl restart systemd-journald.service
 
 # install some handy extra packages
-DEBIAN_FRONTEND=noninteractive apt-get -y install gdu exa pwgen
+DEBIAN_FRONTEND=noninteractive apt-get -y install gdu exa pwgen mailutils --no-install-recommends
+# --no-install-recommends is required to keep mailutils from pulling in postfix & mysql
 
 # install
 chmod 750 sbin/*