2016-11-07 14:00:57 +01:00
|
|
|
---
|
2017-07-19 11:39:38 +02:00
|
|
|
# We have to copy the local jail before installing the package
|
|
|
|
# or we risk being jailed by fail2ban
|
|
|
|
|
2017-11-15 11:46:53 +01:00
|
|
|
- name: Prepare fail2ban hierarchy
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.file:
|
2017-11-15 11:46:53 +01:00
|
|
|
path: "{{ item }}"
|
2017-07-19 11:39:38 +02:00
|
|
|
state: directory
|
|
|
|
owner: root
|
|
|
|
group: root
|
|
|
|
mode: "0755"
|
2021-05-04 14:18:40 +02:00
|
|
|
loop:
|
2017-11-15 11:46:53 +01:00
|
|
|
- "/etc/fail2ban"
|
|
|
|
- "/etc/fail2ban/filter.d"
|
2022-06-08 17:55:58 +02:00
|
|
|
- "/etc/fail2ban/fail2ban.d"
|
2017-07-19 11:39:38 +02:00
|
|
|
tags:
|
2019-01-09 16:43:35 +01:00
|
|
|
- fail2ban
|
2017-07-19 11:39:38 +02:00
|
|
|
|
2023-03-20 23:33:19 +01:00
|
|
|
- ansible.builtin.set_fact:
|
2019-01-09 16:44:16 +01:00
|
|
|
fail2ban_ignore_ips: "{{ ['127.0.0.1/8'] | union(fail2ban_default_ignore_ips) | union(fail2ban_additional_ignore_ips) | unique }}"
|
|
|
|
tags:
|
|
|
|
- fail2ban
|
2018-08-21 23:13:47 +02:00
|
|
|
|
2017-07-19 11:39:38 +02:00
|
|
|
- name: local jail is installed
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.template:
|
2017-07-19 11:39:38 +02:00
|
|
|
src: jail.local.j2
|
|
|
|
dest: /etc/fail2ban/jail.local
|
|
|
|
mode: "0644"
|
2022-06-08 17:55:58 +02:00
|
|
|
force: "{{ fail2ban_override_jaillocal }}"
|
2017-07-19 12:06:19 +02:00
|
|
|
notify: restart fail2ban
|
2017-07-19 11:39:38 +02:00
|
|
|
tags:
|
2019-01-09 16:43:35 +01:00
|
|
|
- fail2ban
|
2017-07-19 11:39:38 +02:00
|
|
|
|
2020-04-11 12:31:41 +02:00
|
|
|
- name: Include ignoredips update task
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.include: ip_whitelist.yml
|
2021-05-09 23:06:42 +02:00
|
|
|
when: fail2ban_force_update_ignore_ips | bool
|
2018-08-23 11:24:11 +02:00
|
|
|
tags:
|
|
|
|
- fail2ban
|
|
|
|
|
2016-11-07 14:00:57 +01:00
|
|
|
- name: custom filters are installed
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.copy:
|
2016-11-07 14:00:57 +01:00
|
|
|
src: "{{ item }}"
|
|
|
|
dest: /etc/fail2ban/filter.d/
|
2017-03-23 16:59:43 +01:00
|
|
|
mode: "0644"
|
2021-05-04 14:18:40 +02:00
|
|
|
loop:
|
2016-11-07 14:00:57 +01:00
|
|
|
- dovecot-evolix.conf
|
|
|
|
- sasl-evolix.conf
|
2017-10-18 15:44:20 +02:00
|
|
|
- wordpress-soft.conf
|
|
|
|
- wordpress-hard.conf
|
2017-10-25 12:12:18 +02:00
|
|
|
- roundcube.conf
|
2016-11-07 14:00:57 +01:00
|
|
|
notify: restart fail2ban
|
2017-07-05 12:00:29 +02:00
|
|
|
tags:
|
|
|
|
- fail2ban
|
2017-10-25 12:11:46 +02:00
|
|
|
|
2022-06-08 17:55:58 +02:00
|
|
|
- name: package fail2ban is installed
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.apt:
|
2017-10-25 12:11:46 +02:00
|
|
|
name: fail2ban
|
|
|
|
state: present
|
|
|
|
tags:
|
|
|
|
- fail2ban
|
|
|
|
- packages
|
2017-12-01 09:00:08 +01:00
|
|
|
|
|
|
|
- name: is Munin present ?
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.stat:
|
2017-12-01 09:00:08 +01:00
|
|
|
path: /etc/munin/plugins
|
|
|
|
check_mode: no
|
|
|
|
register: etc_munin_plugins
|
|
|
|
tags:
|
|
|
|
- fail2ban
|
|
|
|
- munin
|
|
|
|
|
|
|
|
- name: is fail2ban Munin plugin available ?
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.stat:
|
2017-12-01 09:00:08 +01:00
|
|
|
path: /usr/share/munin/plugins/fail2ban
|
|
|
|
check_mode: no
|
|
|
|
register: fail2ban_munin_plugin
|
|
|
|
tags:
|
|
|
|
- fail2ban
|
|
|
|
- munin
|
|
|
|
|
|
|
|
- name: Enable Munin plugins
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.file:
|
2017-12-01 09:00:08 +01:00
|
|
|
src: "/usr/share/munin/plugins/fail2ban"
|
|
|
|
dest: "/etc/munin/plugins/fail2ban"
|
|
|
|
state: link
|
|
|
|
notify: restart munin-node
|
|
|
|
when:
|
2018-01-23 18:31:31 +01:00
|
|
|
- etc_munin_plugins.stat.exists
|
|
|
|
- fail2ban_munin_plugin.stat.exists
|
2017-12-01 09:00:08 +01:00
|
|
|
tags:
|
|
|
|
- fail2ban
|
|
|
|
- munin
|
2022-06-08 17:55:58 +02:00
|
|
|
|
|
|
|
- name: "Extend dbpurgeage if recidive jail is enabled"
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.blockinfile:
|
2022-06-08 17:55:58 +02:00
|
|
|
dest: /etc/fail2ban/fail2ban.d/recidive_dbpurgeage
|
|
|
|
marker: "# ANSIBLE MANAGED"
|
|
|
|
block: |
|
|
|
|
[DEFAULT]
|
2022-12-28 09:03:37 +01:00
|
|
|
dbpurgeage = {{ fail2ban_recidive_bantime }}
|
2022-06-08 17:55:58 +02:00
|
|
|
insertafter: EOF
|
|
|
|
create: yes
|
|
|
|
mode: "0644"
|
|
|
|
notify: restart fail2ban
|
|
|
|
when:
|
2022-07-08 11:26:00 +02:00
|
|
|
- fail2ban_recidive
|
|
|
|
|
|
|
|
- name: Fix dbpurgeage for stretch and buster
|
2023-03-20 23:33:19 +01:00
|
|
|
ansible.builtin.include: fix-dbpurgeage.yml
|
2022-07-08 11:26:00 +02:00
|
|
|
when:
|
|
|
|
- ansible_distribution_release == "stretch" or ansible_distribution_release == "buster"
|
|
|
|
tags:
|
|
|
|
- fail2ban
|