ansible-personal/roles/common/handlers/main.yml

---
# file: roles/common/handlers/main.yml

- name: reload sshd
  systemd: name={{ sshd_service_name }} state=reloaded

- name: reload sysctl
  command: sysctl -p /etc/sysctl.conf

- name: restart firewalld
  systemd: name=firewalld state=restarted

- name: reload systemd
  systemd: daemon_reload=yes

- name: restart nftables
  systemd: name=nftables state=restarted

# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed
# in the order they are defined, not in the order they are listed in the task's
# notify statement and we must restart fail2ban after updating the firewall.
- name: restart fail2ban
  systemd: name=fail2ban state=restarted
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
			`# file: roles/common/handlers/main.yml`

roles/common: Reload sshd instead of restarting No need to restart for a config change. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:01:17 +02:00			`- name: reload sshd`
roles/common: Use systemd module instead of "service" This was new in Ansible 2.2 but I didn't notice until now. All of our servers are running distributions with systemd so let's just use this. 2017-11-02 17:55:20 +01:00			`systemd: name={{ sshd_service_name }} state=reloaded`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
			`- name: reload sysctl`
			`command: sysctl -p /etc/sysctl.conf`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00
roles/common: Restart firewalld instead of reload I'm having problems with reload hanging on Debian 10 so I will just revert to the older behavior of restarting. 2019-10-05 11:29:30 +02:00			`- name: restart firewalld`
			`systemd: name=firewalld state=restarted`
roles/common: Add support for fail2ban This is active banning of IPs that are brute forcing login attempts to SSH, versus the passive banning of 10,000 abusive IPs from the abuseipdb.com blacklist. For now I am banning IPs that fail to log in successfully more than twelve times in a one-hour period, but these settings might change, and I can override them at the group and host level if needed. Currently this works for CentOS 7, Ubuntu 16.04, and Ubuntu 18.04, with minor differences in the systemd configuration due to older versions on some distributions. You can see the status of the jail like this: # fail2ban-client status sshd Status for the jail: sshd \|- Filter \| \|- Currently failed: 0 \| \|- Total failed: 0 \| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions \|- Currently banned: 1 \|- Total banned: 1 `- Banned IP list: 106.13.112.20 You can unban IPs like this: # fail2ban-client set sshd unbanip 106.13.112.20 2019-10-26 16:36:07 +02:00
			`- name: reload systemd`
			`systemd: daemon_reload=yes`
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support. 2021-07-26 12:09:41 +02:00
roles/common: Fix typo in handlers 2021-09-05 15:19:31 +02:00			`- name: restart nftables`
roles/common: Always restart nftables service The "reload" capability only exists on Ubuntu, and it is exactly the same as the "restart" functionality. 2021-08-01 13:23:00 +02:00			`systemd: name=nftables state=restarted`
roles/common: notify fail2ban after updating firewall We should always restart fail2ban after updating the firewall. Also note that the order of execution of handlers depends on how they are defined in the handler config, not on the order they are listed in the task's notify statement. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html 2021-09-28 09:45:51 +02:00
			`# 2021-09-28: note to self to keep fail2ban at the end, as handlers are executed`
			`# in the order they are defined, not in the order they are listed in the task's`
			`# notify statement and we must restart fail2ban after updating the firewall.`
			`- name: restart fail2ban`
			`systemd: name=fail2ban state=restarted`