alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
d9f7c7a93b
ansible-personal/roles/common/tasks/firewall_Ubuntu.yml

115 lines
3.2 KiB
YAML
Raw Normal View History

roles/common: Separate firewalld tasks for Ubuntu and Debian Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 11:06:25 +02:00
---
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
# Ubuntu 20.04 will use nftables directly, with no firewalld.
roles/common: Separate firewalld tasks for Ubuntu and Debian Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-08-23 11:06:25 +02:00
roles/common: Use blocks to tag children of dynamic tasks When using dynamic includes, child tasks do not inherit tags from their parents. You must tag the parent and each child task separately, or use a block to group children and then apply a tag to a block. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-26 15:58:35 +02:00
- block:
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
- name: Install Ubuntu firewall packages
ansible.builtin.package:
name:
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
- fail2ban
- libnet-ip-perl # for aggregate-cidr-addresses.pl
- nftables
- python3-systemd
roles/common: Install curl for Abuse.ch update scripts
2021-07-29 09:24:32 +02:00
- curl # for nftables update scripts
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
state: present
cache_valid_time: 3600
roles/common: Use blocks to tag children of dynamic tasks When using dynamic includes, child tasks do not inherit tags from their parents. You must tag the parent and each child task separately, or use a block to group children and then apply a tag to a block. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-26 15:58:35 +02:00
roles/common: Remove ufw from Ubuntu systems We never used this simple firewall utility and in at least one case a user on the server tried to use it and messed up the rules I had set via firewalld.
2020-04-25 12:54:50 +02:00
- name: Remove ufw
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.package:
name: ufw
state: absent
roles/common: Remove ufw from Ubuntu systems We never used this simple firewall utility and in at least one case a user on the server tried to use it and messed up the rules I had set via firewalld.
2020-04-25 12:54:50 +02:00
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
- name: Copy nftables.conf
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.template:
src: nftables.conf.j2
dest: /etc/nftables.conf
owner: root
mode: 0644
roles/common: Use nftables backend in firewalld on Ubuntu 20.04 The nftables backend should be more performant and flexible. I had been planning to use it on Ubuntu 18.04 and Debian 10 as well, but there were issues with the specific versions used in those distros. See: https://firewalld.org/2018/07/nftables-backend
2020-04-25 13:21:17 +02:00
notify:
roles/common: Always restart nftables service The "reload" capability only exists on Ubuntu, and it is exactly the same as the "restart" functionality.
2021-08-01 13:23:00 +02:00
- restart nftables
roles/common: notify fail2ban after updating firewall We should always restart fail2ban after updating the firewall. Also note that the order of execution of handlers depends on how they are defined in the handler config, not on the order they are listed in the task's notify statement. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html
2021-09-28 09:45:51 +02:00
- restart fail2ban
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
- name: Create /etc/nftables extra config directory
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.file:
path: /etc/nftables
state: directory
owner: root
mode: 0755
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
- name: Copy extra nftables configuration files
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.copy:
src: "{{ item.src }}"
dest: "/etc/nftables/{{ item.src }}"
owner: root
group: root
mode: 0644
force: "{{ item.force }}"
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
loop:
roles/common: fix logic for copying AbuseIPDB.com nft sets We have to force these because they are not updated on the host like the other lists (API limit of five requests per day!). We update the list periodically here in git.
2021-09-08 08:58:13 +02:00
- { src: "spamhaus-ipv4.nft", force: "no" }
- { src: "spamhaus-ipv6.nft", force: "no" }
- { src: "abusech-ipv4.nft", force: "no" }
- { src: "abuseipdb-ipv4.nft", force: "yes" }
- { src: "abuseipdb-ipv6.nft", force: "yes" }
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
notify:
roles/common: Always restart nftables service The "reload" capability only exists on Ubuntu, and it is exactly the same as the "restart" functionality.
2021-08-01 13:23:00 +02:00
- restart nftables
roles/common: notify fail2ban after updating firewall We should always restart fail2ban after updating the firewall. Also note that the order of execution of handlers depends on how they are defined in the handler config, not on the order they are listed in the task's notify statement. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html
2021-09-28 09:45:51 +02:00
- restart fail2ban
roles/common: Use nftables backend in firewalld on Ubuntu 20.04 The nftables backend should be more performant and flexible. I had been planning to use it on Ubuntu 18.04 and Debian 10 as well, but there were issues with the specific versions used in those distros. See: https://firewalld.org/2018/07/nftables-backend
2020-04-25 13:21:17 +02:00
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- name: Copy nftables update scripts
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.copy:
src: "{{ item }}"
dest: "/usr/local/bin/{{ item }}"
mode: 0755
owner: root
group: root
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
loop:
- update-spamhaus-nftables.sh
- aggregate-cidr-addresses.pl
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- update-abusech-nftables.sh
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- name: Copy nftables systemd units
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.copy:
src: "{{ item }}"
dest: "/etc/systemd/system/{{ item }}"
mode: 0644
owner: root
group: root
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
loop:
- update-spamhaus-nftables.service
- update-spamhaus-nftables.timer
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- update-abusech-nftables.service
- update-abusech-nftables.timer
register: nftables_systemd_units
roles/common: Add Spamhaus DROP lists to firewalld ipsets This configures the recommended DROP, EDROP, and DROPv6 lists from Spamhaus as ipsets in firewalld. First we copy an empty placeholder ipset to seed firewalld, then we use a shell script to download the real lists and activate them. The same shell script is run daily as a service (update-spamhaus-lists.service) by a systemd timer. I am strictly avoiding any direct ipset commands here because I want to make sure that this works on older hosts where ipsets is used as well as newer hosts that have moved to nftables such as Ubuntu 20.04. So far I have tested this on Ubuntu 16.04, 18.04, and 20.04, but ev- entually I need to abstract the tasks and run them on CentOS 7+ as well. See: https://www.spamhaus.org/drop/
2021-07-21 08:34:51 +02:00
# need to reload to pick up service/timer/environment changes
- name: Reload systemd daemon
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.systemd:
daemon_reload: true
Remove Ubuntu 18.04 support
2022-09-10 22:26:55 +02:00
when: nftables_systemd_units is changed
roles/common: Add support for fail2ban This is active banning of IPs that are brute forcing login attempts to SSH, versus the passive banning of 10,000 abusive IPs from the abuseipdb.com blacklist. For now I am banning IPs that fail to log in successfully more than twelve times in a one-hour period, but these settings might change, and I can override them at the group and host level if needed. Currently this works for CentOS 7, Ubuntu 16.04, and Ubuntu 18.04, with minor differences in the systemd configuration due to older versions on some distributions. You can see the status of the jail like this: # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 106.13.112.20 You can unban IPs like this: # fail2ban-client set sshd unbanip 106.13.112.20
2019-10-26 16:36:07 +02:00
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- name: Start and enable nftables update timers
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.systemd:
name: "{{ item }}"
state: started
enabled: true
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
loop:
- update-spamhaus-nftables.timer
- update-abusech-nftables.timer
roles/common: Use nftables on Ubuntu 20.04 as well This mostly copies the Debian 11 nftables setup and includes a play to clean up the old firewalld settings, timers, etc.
2021-07-28 13:18:41 +02:00
roles/common: Start nftables service later We should only try to start the nftables service after we finish copying all the config files just in case there is some unclean state in one of them. On a first run this shouldn't matter, but after nftables and some abuse list update scripts have run this can happen (mostly in testing!).
2021-07-29 09:05:15 +02:00
- name: Start and enable nftables
when: ansible_distribution_version is version('20.04', '>=')
roles/common: rework firewall_Ubuntu.yml playbook Use newer Ansible task format, move from apt to package module, and do package installs in one transaction using a list instead of a loop.
2022-09-12 16:18:33 +02:00
ansible.builtin.systemd:
name: nftables
state: started
enabled: true
roles/common: Start nftables service later We should only try to start the nftables service after we finish copying all the config files just in case there is some unclean state in one of them. On a first run this shouldn't matter, but after nftables and some abuse list update scripts have run this can happen (mostly in testing!).
2021-07-29 09:05:15 +02:00
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
- ansible.builtin.include_tasks: fail2ban.yml
Use version() instad of version_compare() This changed in Ansible 2.5 apparently. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_tests.html
2020-03-09 14:20:51 +01:00
when: ansible_distribution_version is version('16.04', '>=')
roles/common: Use dynamic include_tasks for firewall Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks.
2018-04-25 17:58:31 +02:00
tags: firewall
roles/common: Add missing vim modelines
2018-04-25 17:55:22 +02:00
# vim: set sw=2 ts=2:
Reference in New Issue Copy Permalink