ansible-personal/roles/common/handlers/main.yml

---
# file: roles/common/handlers/main.yml

- name: restart iptables
  service: name=iptables state=restarted

- name: restart iptables-persistent
  service: name=iptables-persistent state=restarted

- name: reload sshd
  systemd: name={{ sshd_service_name }} state=reloaded

- name: reload sysctl
  command: sysctl -p /etc/sysctl.conf

- name: restart firewalld
  systemd: name=firewalld state=restarted

- name: restart fail2ban
  systemd: name=fail2ban state=restarted

- name: reload systemd
  systemd: daemon_reload=yes
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00			`---`
			`# file: roles/common/handlers/main.yml`

			`- name: restart iptables`
			`service: name=iptables state=restarted`

			`- name: restart iptables-persistent`
			`service: name=iptables-persistent state=restarted`

roles/common: Reload sshd instead of restarting No need to restart for a config change. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-08-22 23:01:17 +02:00			`- name: reload sshd`
roles/common: Use systemd module instead of "service" This was new in Ansible 2.2 but I didn't notice until now. All of our servers are running distributions with systemd so let's just use this. 2017-11-02 17:55:20 +01:00			`systemd: name={{ sshd_service_name }} state=reloaded`
Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com> 2014-08-16 23:35:57 +02:00
			`- name: reload sysctl`
			`command: sysctl -p /etc/sysctl.conf`
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com> 2015-06-07 11:42:03 +02:00
roles/common: Restart firewalld instead of reload I'm having problems with reload hanging on Debian 10 so I will just revert to the older behavior of restarting. 2019-10-05 11:29:30 +02:00			`- name: restart firewalld`
			`systemd: name=firewalld state=restarted`
roles/common: Add support for fail2ban This is active banning of IPs that are brute forcing login attempts to SSH, versus the passive banning of 10,000 abusive IPs from the abuseipdb.com blacklist. For now I am banning IPs that fail to log in successfully more than twelve times in a one-hour period, but these settings might change, and I can override them at the group and host level if needed. Currently this works for CentOS 7, Ubuntu 16.04, and Ubuntu 18.04, with minor differences in the systemd configuration due to older versions on some distributions. You can see the status of the jail like this: # fail2ban-client status sshd Status for the jail: sshd \|- Filter \| \|- Currently failed: 0 \| \|- Total failed: 0 \| `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions \|- Currently banned: 1 \|- Total banned: 1 `- Banned IP list: 106.13.112.20 You can unban IPs like this: # fail2ban-client set sshd unbanip 106.13.112.20 2019-10-26 16:36:07 +02:00
			`- name: restart fail2ban`
			`systemd: name=fail2ban state=restarted`

			`- name: reload systemd`
			`systemd: daemon_reload=yes`