alanorth/ansible-personal
1
0
Fork 0
Code Issues 4 Pull Requests Projects Releases Wiki Activity
fcb12ecee0
ansible-personal/roles/common/tasks/firewall_Debian.yml

85 lines
3.2 KiB
YAML
Raw Normal View History

Initial commit Signed-off-by: Alan Orth <alan.orth@gmail.com>
2014-08-16 23:35:57 +02:00
---
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
# Debian 11 will use nftables directly, with no firewalld.
roles/common: Add firewalld support Needed in Ubuntu 15.04 where iptables-persistent is going away. I have added translations of the current IPv4 and IPv6 iptables rules. Signed-off-by: Alan Orth <alan.orth@gmail.com>
2015-06-07 11:42:03 +02:00
roles/common: Use blocks to tag children of dynamic tasks When using dynamic includes, child tasks do not inherit tags from their parents. You must tag the parent and each child task separately, or use a block to group children and then apply a tag to a block. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-26 15:58:35 +02:00
- block:
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
- name: Set Debian firewall packages
when: ansible_distribution_major_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.set_fact:
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
debian_firewall_packages:
- fail2ban
- libnet-ip-perl # for aggregate-cidr-addresses.pl
- nftables
- python3-systemd
roles/common: Install curl for Abuse.ch update scripts
2021-07-29 09:24:32 +02:00
- curl # for nftables update scripts
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
- name: Install firewall packages
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.apt: pkg={{ debian_firewall_packages }} state=present cache_valid_time=3600
roles/common: Use blocks to tag children of dynamic tasks When using dynamic includes, child tasks do not inherit tags from their parents. You must tag the parent and each child task separately, or use a block to group children and then apply a tag to a block. See: https://docs.ansible.com/ansible/devel/porting_guides/porting_guide_2.5.html
2018-04-26 15:58:35 +02:00
roles/common: Remove iptables on newer Debian
2021-09-27 09:35:38 +02:00
- name: Remove iptables on newer Debian
when: ansible_distribution_major_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.apt: pkg=iptables state=absent
roles/common: Remove iptables on newer Debian
2021-09-27 09:35:38 +02:00
roles/common: Fix nftables in Debian firewall The previous commit meant to move the service start, not the config copying task.
2021-07-29 09:10:04 +02:00
- name: Copy nftables.conf
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
when: ansible_distribution_major_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.template: src=nftables.conf.j2 dest=/etc/nftables.conf owner=root mode=0644
roles/common: Fix nftables in Debian firewall The previous commit meant to move the service start, not the config copying task.
2021-07-29 09:10:04 +02:00
notify:
roles/common: Fix nftables handler in Debian firewall We used to use reload, but now the idempotent thing to do is to use restart instead of reload.
2021-09-07 14:43:33 +02:00
- restart nftables
roles/common: notify fail2ban after updating firewall We should always restart fail2ban after updating the firewall. Also note that the order of execution of handlers depends on how they are defined in the handler config, not on the order they are listed in the task's notify statement. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html
2021-09-28 09:45:51 +02:00
- restart fail2ban
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
- name: Create /etc/nftables extra config directory
when: ansible_distribution_major_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.file: path=/etc/nftables state=directory owner=root mode=0755
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
- name: Copy extra nftables configuration files
when: ansible_distribution_major_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.copy: src={{ item.src }} dest=/etc/nftables/{{ item.src }} owner=root group=root mode=0644 force={{ item.force }}
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
loop:
roles/common: fix logic for copying AbuseIPDB.com nft sets We have to force these because they are not updated on the host like the other lists (API limit of five requests per day!). We update the list periodically here in git.
2021-09-08 08:58:13 +02:00
- { src: "spamhaus-ipv4.nft", force: "no" }
- { src: "spamhaus-ipv6.nft", force: "no" }
- { src: "abusech-ipv4.nft", force: "no" }
- { src: "abuseipdb-ipv4.nft", force: "yes" }
- { src: "abuseipdb-ipv6.nft", force: "yes" }
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
notify:
roles/common: Fix nftables handler in Debian firewall We used to use reload, but now the idempotent thing to do is to use restart instead of reload.
2021-09-07 14:43:33 +02:00
- restart nftables
roles/common: notify fail2ban after updating firewall We should always restart fail2ban after updating the firewall. Also note that the order of execution of handlers depends on how they are defined in the handler config, not on the order they are listed in the task's notify statement. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_handlers.html
2021-09-28 09:45:51 +02:00
- restart fail2ban
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
- name: Copy Spamhaus nftables update scripts
when: ansible_distribution_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.copy: src={{ item }} dest=/usr/local/bin/{{ item }} mode=0755 owner=root group=root
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
loop:
- update-spamhaus-nftables.sh
- aggregate-cidr-addresses.pl
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- update-abusech-nftables.sh
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- name: Copy nftables systemd units
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
when: ansible_distribution_version is version('11', '>=')
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
ansible.builtin.copy: src={{ item }} dest=/etc/systemd/system/{{ item }} mode=0644 owner=root group=root
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
loop:
- update-spamhaus-nftables.service
- update-spamhaus-nftables.timer
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- update-abusech-nftables.service
- update-abusech-nftables.timer
register: nftables_systemd_units
roles/common: bring Ubuntu firewall changes to Debian 11 Note that there is currently an issue loading the spamhaus rules on Debian 11 when using ipsets with firewalld and the nftables backend. The bug is apparently caused by overlapping CIDR segments, and the solution appears to be that we need to manually aggregate them with a tool like aggregate6 (Python). See: https://bugzilla.redhat.com/show_bug.cgi?id=1836571 See: https://wiki.fysik.dtu.dk/it/Linux_firewall_configuration#using-ipsets-in-firewalld-on-rhel-centos-8 See: https://github.com/job/aggregate6
2021-07-24 22:09:33 +02:00
# need to reload to pick up service/timer/environment changes
- name: Reload systemd daemon
roles: strict truthy values According to Ansible we can use yes, true, True, "or any quoted st- ring" for a boolean true, but ansible-lint wants us to use either true or false. See: https://chronicler.tech/red-hat-ansible-yes-no-and/
2022-09-10 21:33:19 +02:00
ansible.builtin.systemd: daemon_reload=true
Remove Debian 10 support
2022-09-11 08:21:08 +02:00
when: nftables_systemd_units is changed
roles/common: Add support for fail2ban This is active banning of IPs that are brute forcing login attempts to SSH, versus the passive banning of 10,000 abusive IPs from the abuseipdb.com blacklist. For now I am banning IPs that fail to log in successfully more than twelve times in a one-hour period, but these settings might change, and I can override them at the group and host level if needed. Currently this works for CentOS 7, Ubuntu 16.04, and Ubuntu 18.04, with minor differences in the systemd configuration due to older versions on some distributions. You can see the status of the jail like this: # fail2ban-client status sshd Status for the jail: sshd |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- Journal matches: _SYSTEMD_UNIT=sshd.service + _COMM=sshd `- Actions |- Currently banned: 1 |- Total banned: 1 `- Banned IP list: 106.13.112.20 You can unban IPs like this: # fail2ban-client set sshd unbanip 106.13.112.20
2019-10-26 16:36:07 +02:00
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
- name: Start and enable nftables update timers
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
when: ansible_distribution_version is version('11', '>=')
roles: strict truthy values According to Ansible we can use yes, true, True, "or any quoted st- ring" for a boolean true, but ansible-lint wants us to use either true or false. See: https://chronicler.tech/red-hat-ansible-yes-no-and/
2022-09-10 21:33:19 +02:00
ansible.builtin.systemd: name={{ item }} state=started enabled=true
roles/common: Use Abuse.ch's SSL Blacklist in nftables This adds Abuse.sh's list of IPs using blacklisted SSL certificates to nftables. These IPs are high confidence indicators of compromise and we should not route them. The list is updated daily by a systemd timer. See: https://sslbl.abuse.ch/blacklist/
2021-07-29 09:16:00 +02:00
loop:
- update-spamhaus-nftables.timer
- update-abusech-nftables.timer
roles/common: Add initial support for nftables on Debian 11 I will try using nftables directly instead of via firewalld as of Debian 11 as it is the replacement for the iptables/ipset stack in recent years and is easier to work with. This also includes a systemd service, timer, and script to update the spamhaus DROP lists as nftables sets. Still need to add fail2ban support.
2021-07-26 12:09:41 +02:00
roles/common: Fix nftables in Debian firewall The previous commit meant to move the service start, not the config copying task.
2021-07-29 09:10:04 +02:00
- name: Start and enable nftables
roles/common: Start nftables service later We should only try to start the nftables service after we finish copying all the config files just in case there is some unclean state in one of them. On a first run this shouldn't matter, but after nftables and some abuse list update scripts have run this can happen (mostly in testing!).
2021-07-29 09:05:15 +02:00
when: ansible_distribution_major_version is version('11', '>=')
roles: strict truthy values According to Ansible we can use yes, true, True, "or any quoted st- ring" for a boolean true, but ansible-lint wants us to use either true or false. See: https://chronicler.tech/red-hat-ansible-yes-no-and/
2022-09-10 21:33:19 +02:00
ansible.builtin.systemd: name=nftables state=started enabled=true
roles/common: Start nftables service later We should only try to start the nftables service after we finish copying all the config files just in case there is some unclean state in one of them. On a first run this shouldn't matter, but after nftables and some abuse list update scripts have run this can happen (mostly in testing!).
2021-07-29 09:05:15 +02:00
roles: use fully qualified module names
2022-09-10 17:09:12 +02:00
- ansible.builtin.include_tasks: fail2ban.yml
Use version() instad of version_compare() This changed in Ansible 2.5 apparently. See: https://docs.ansible.com/ansible/latest/user_guide/playbooks_tests.html
2020-03-09 14:20:51 +01:00
when: ansible_distribution_major_version is version('9', '>=')
roles/common: Use dynamic include_tasks for firewall Use dynamic includes instead of static imports when you are running tasks conditionally or using variable interpolation. The down side is that you need to then tag the parent task as well as all child tasks, as tags only apply to children of statically imported tasks.
2018-04-25 17:58:31 +02:00
tags: firewall
roles/common: Add missing vim modelines
2018-04-25 17:55:22 +02:00
# vim: set sw=2 ts=2:
Reference in New Issue Copy Permalink