ansible-roles/fail2ban/tasks/main.yml

---
# We have to copy the local jail before installing the package
# or we risk being jailed by fail2ban

- name: Prepare fail2ban hierarchy
  file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  with_items:
    - "/etc/fail2ban"
    - "/etc/fail2ban/filter.d"
  tags:
    - fail2ban

- set_fact:
    fail2ban_ignore_ips: "{{ ['127.0.0.1/8'] | union(fail2ban_default_ignore_ips) | union(fail2ban_additional_ignore_ips) | unique }}"
  tags:
    - fail2ban

- name: local jail is installed
  template:
    src: jail.local.j2
    dest: /etc/fail2ban/jail.local
    mode: "0644"
    force: no
  notify: restart fail2ban
  tags:
    - fail2ban

- name: Include ignoredips update task
  include: ip_whitelist.yml
  when: fail2ban_force_update_ignore_ips
  tags:
    - fail2ban

- name: Disable SSH filter
  ini_file:
    dest: /etc/fail2ban/jail.local
    section: sshd
    option: enabled
    value: false
  notify: restart fail2ban
  when: fail2ban_disable_ssh
  tags:
    - fail2ban

- name: custom filters are installed
  copy:
    src: "{{ item }}"
    dest: /etc/fail2ban/filter.d/
    mode: "0644"
  with_items:
    - dovecot-evolix.conf
    - sasl-evolix.conf
    - wordpress-soft.conf
    - wordpress-hard.conf
    - roundcube.conf
  notify: restart fail2ban
  tags:
    - fail2ban

- name: package is installed
  apt:
    name: fail2ban
    state: present
  tags:
    - fail2ban
    - packages

- name: is Munin present ?
  stat:
    path: /etc/munin/plugins
  check_mode: no
  register: etc_munin_plugins
  tags:
    - fail2ban
    - munin

- name: is fail2ban Munin plugin available ?
  stat:
    path: /usr/share/munin/plugins/fail2ban
  check_mode: no
  register: fail2ban_munin_plugin
  tags:
    - fail2ban
    - munin

- name: Enable Munin plugins
  file:
    src: "/usr/share/munin/plugins/fail2ban"
    dest: "/etc/munin/plugins/fail2ban"
    state: link
  notify: restart munin-node
  when:
    - etc_munin_plugins.stat.exists
    - fail2ban_munin_plugin.stat.exists
  tags:
    - fail2ban
    - munin
Squash: conventions, evolinux, etc-git… 2016-11-07 14:00:57 +01:00			`---`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`# We have to copy the local jail before installing the package`
			`# or we risk being jailed by fail2ban`

fail2ban: create config hierarchy beforehand 2017-11-15 11:46:53 +01:00			`- name: Prepare fail2ban hierarchy`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`file:`
fail2ban: create config hierarchy beforehand 2017-11-15 11:46:53 +01:00			`path: "{{ item }}"`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`state: directory`
			`owner: root`
			`group: root`
			`mode: "0755"`
fail2ban: create config hierarchy beforehand 2017-11-15 11:46:53 +01:00			`with_items:`
			`- "/etc/fail2ban"`
			`- "/etc/fail2ban/filter.d"`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`tags:`
whitespaces 2019-01-09 16:43:35 +01:00			`- fail2ban`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00
fail2ban: fix fail2ban_ignore_ips definition If the final variable is combined in the defaults file, it's component can be overridden, but the final variable can't be overriden. 2018-08-21 23:13:47 +02:00			`- set_fact:`
fail2ban: fix "ignoreip" update 2019-01-09 16:44:16 +01:00			`fail2ban_ignore_ips: "{{ ['127.0.0.1/8'] \| union(fail2ban_default_ignore_ips) \| union(fail2ban_additional_ignore_ips) \| unique }}"`
			`tags:`
			`- fail2ban`
fail2ban: fix fail2ban_ignore_ips definition If the final variable is combined in the defaults file, it's component can be overridden, but the final variable can't be overriden. 2018-08-21 23:13:47 +02:00
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`- name: local jail is installed`
			`template:`
			`src: jail.local.j2`
			`dest: /etc/fail2ban/jail.local`
			`mode: "0644"`
fail2ban: the local jail should not be overwritten 2017-07-19 11:55:04 +02:00			`force: no`
fail2ban: unindent notify attribute 2017-07-19 12:06:19 +02:00			`notify: restart fail2ban`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00			`tags:`
whitespaces 2019-01-09 16:43:35 +01:00			`- fail2ban`
fail2ban: install local jail before starting 2017-07-19 11:39:38 +02:00
trailing space 2020-04-11 12:31:41 +02:00			`- name: Include ignoredips update task`
Make ip whitelist tasks more flexible Now the list of whitelisted ip addresses can be updated simply by including the specific tasks in an external playbook without polluting our role list. This change takes effect for nginx, apache and fail2ban. 2018-10-29 21:53:46 +01:00			`include: ip_whitelist.yml`
fail2ban: fix typo in variable name 2018-08-23 16:48:50 +02:00			`when: fail2ban_force_update_ignore_ips`
fail2ban: add a variable to update the list of ignored IP addresses 2018-08-23 11:24:11 +02:00			`tags:`
			`- fail2ban`

fail2ban: add a variable to disable the ssh filter (default: False) 2018-08-23 09:16:33 +02:00			`- name: Disable SSH filter`
			`ini_file:`
			`dest: /etc/fail2ban/jail.local`
			`section: sshd`
			`option: enabled`
			`value: false`
			`notify: restart fail2ban`
			`when: fail2ban_disable_ssh`
			`tags:`
			`- fail2ban`

Squash: conventions, evolinux, etc-git… 2016-11-07 14:00:57 +01:00			`- name: custom filters are installed`
			`copy:`
			`src: "{{ item }}"`
			`dest: /etc/fail2ban/filter.d/`
Change mode with leading 0, but still as String 2017-03-23 16:59:43 +01:00			`mode: "0644"`
Squash: conventions, evolinux, etc-git… 2016-11-07 14:00:57 +01:00			`with_items:`
			`- dovecot-evolix.conf`
			`- sasl-evolix.conf`
fail2ban: add wordpress filters 2017-10-18 15:44:20 +02:00			`- wordpress-soft.conf`
			`- wordpress-hard.conf`
fail2ban: add roundcube filter 2017-10-25 12:12:18 +02:00			`- roundcube.conf`
Squash: conventions, evolinux, etc-git… 2016-11-07 14:00:57 +01:00			`notify: restart fail2ban`
fail2ban: custom ignoreip + add tags 2017-07-05 12:00:29 +02:00			`tags:`
			`- fail2ban`
fail2ban: install filter before package 2017-10-25 12:11:46 +02:00
			`- name: package is installed`
			`apt:`
			`name: fail2ban`
			`state: present`
			`tags:`
			`- fail2ban`
			`- packages`
fail2ban: Install munin plugin if available 2017-12-01 09:00:08 +01:00
			`- name: is Munin present ?`
			`stat:`
			`path: /etc/munin/plugins`
			`check_mode: no`
			`register: etc_munin_plugins`
			`tags:`
			`- fail2ban`
			`- munin`

			`- name: is fail2ban Munin plugin available ?`
			`stat:`
			`path: /usr/share/munin/plugins/fail2ban`
			`check_mode: no`
			`register: fail2ban_munin_plugin`
			`tags:`
			`- fail2ban`
			`- munin`

			`- name: Enable Munin plugins`
			`file:`
			`src: "/usr/share/munin/plugins/fail2ban"`
			`dest: "/etc/munin/plugins/fail2ban"`
			`state: link`
			`notify: restart munin-node`
			`when:`
fail2ban: fix horrible typo, Python is not Ruby 2018-01-23 18:31:31 +01:00			`- etc_munin_plugins.stat.exists`
			`- fail2ban_munin_plugin.stat.exists`
fail2ban: Install munin plugin if available 2017-12-01 09:00:08 +01:00			`tags:`
			`- fail2ban`
			`- munin`