ansible-personal/roles/common/handlers/main.yml

---
# file: roles/common/handlers/main.yml

- name: reload sshd
  systemd: name={{ sshd_service_name }} state=reloaded

- name: reload sysctl
  command: sysctl -p /etc/sysctl.conf

- name: restart firewalld
  systemd: name=firewalld state=restarted

- name: restart fail2ban
  systemd: name=fail2ban state=restarted

- name: reload systemd
  systemd: daemon_reload=yes

- name: reload nftables
  systemd: name=nftables state=reloaded
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
			`# file: roles/common/handlers/main.yml`

roles/common: Reload sshd instead of restarting No need to restart for a config change. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:01:17 +02:00			`- name: reload sshd`
roles/common: Use systemd module instead of "service" This was new in Ansible 2.2 but I didn't notice until now. All of our servers are running distributions with systemd so let's just use this. 2017-11-02 17:55:20 +01:00			`systemd: name={{ sshd_service_name }} state=reloaded`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
			`- name: reload sysctl`
			`command: sysctl -p /etc/sysctl.conf`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00
roles/common: Restart firewalld instead of reload I'm having problems with reload hanging on Debian 10 so I will just revert to the older behavior of restarting. 2019-10-05 11:29:30 +02:00			`- name: restart firewalld`
			`systemd: name=firewalld state=restarted`
roles/common: Add support for fail2ban This is active banning of IPs that are brute forcing login attempts to SSH, versus the passive banning of 10,000 abusive IPs from the abuseipdb.com blacklist. For now I am banning IPs that fail to log in successfully more than twelve times in a one-hour period, but these settings might change, and I can override them at the group and host level if needed. Currently this works for CentOS 7, Ubuntu 16.04, and Ubuntu 18.04, with minor differences in the systemd configuration due to older versions on some distributions. You can see the status of the jail like this: # fail2ban-client status sshd Status for the jail: sshd \|- Filter \| \|- Currently failed: 0 \| \|- Total failed: 0 \| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions \|- Currently banned: 1 \|- Total banned: 1 `- Banned IP list: 106.13.112.20 You can unban IPs like this: # fail2ban-client set sshd unbanip 106.13.112.20 2019-10-26 16:36:07 +02:00
			`- name: restart fail2ban`
			`systemd: name=fail2ban state=restarted`

			`- name: reload systemd`
			`systemd: daemon_reload=yes`
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support. 2021-07-26 12:09:41 +02:00
			`- name: reload nftables`
			`systemd: name=nftables state=reloaded`