From c2a92269e4c3eaf3809873c6488f5c3449e74b1e Mon Sep 17 00:00:00 2001 From: Alan Orth Date: Sat, 5 Oct 2019 12:28:30 +0300 Subject: [PATCH] roles/common: Add ipsets of abusive IPs to firewalld This uses the ipsets feature of the Linux kernel to create lists of IPs (though could be MACs, IP:port, etc) that we can block via the existing firewalld zone we are already using. In my testing it works on CentOS 7, Ubuntu 16.04, and Ubuntu 18.04. The list of abusive IPs currently comes from HPC's systemd journal, where I filtered for hosts that had attempted and failed to log in over 100 times. The list is formatted with tidy, for example: $ tidy -xml -iq -m -w 0 roles/common/files/abusers-ipv4.xml See: https://firewalld.org/2015/12/ipset-support --- roles/common/files/abusers-ipv4.xml | 463 +++++++++++++++++++++++++ roles/common/files/abusers-ipv6.xml | 7 + roles/common/tasks/firewall_Debian.yml | 9 + roles/common/tasks/firewall_Ubuntu.yml | 9 + 4 files changed, 488 insertions(+) create mode 100644 roles/common/files/abusers-ipv4.xml create mode 100644 roles/common/files/abusers-ipv6.xml diff --git a/roles/common/files/abusers-ipv4.xml b/roles/common/files/abusers-ipv4.xml new file mode 100644 index 0000000..c74992a --- /dev/null +++ b/roles/common/files/abusers-ipv4.xml @@ -0,0 +1,463 @@ + + + diff --git a/roles/common/files/abusers-ipv6.xml b/roles/common/files/abusers-ipv6.xml new file mode 100644 index 0000000..3c4c766 --- /dev/null +++ b/roles/common/files/abusers-ipv6.xml @@ -0,0 +1,7 @@ + + + diff --git a/roles/common/tasks/firewall_Debian.yml b/roles/common/tasks/firewall_Debian.yml index bab1664..477c787 100644 --- a/roles/common/tasks/firewall_Debian.yml +++ b/roles/common/tasks/firewall_Debian.yml @@ -21,6 +21,15 @@ command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml notify: - reload firewalld + + - name: Copy ipsets of abusive IPs + when: ansible_distribution_major_version is version_compare('8', '>=') + copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600 + loop: + - abusers-ipv4.xml + - abusers-ipv6.xml + notify: + - reload firewalld tags: firewall # vim: set sw=2 ts=2: diff --git a/roles/common/tasks/firewall_Ubuntu.yml b/roles/common/tasks/firewall_Ubuntu.yml index 9394493..22216d5 100644 --- a/roles/common/tasks/firewall_Ubuntu.yml +++ b/roles/common/tasks/firewall_Ubuntu.yml @@ -17,6 +17,15 @@ command: tidy -xml -iq -m -w 0 /etc/firewalld/zones/public.xml notify: - reload firewalld + + - name: Copy ipsets of abusive IPs + when: ansible_distribution_major_version is version_compare('15.04', '>=') + copy: src={{ item }} dest=/etc/firewalld/ipsets/{{ item }} owner=root group=root mode=0600 + loop: + - abusers-ipv4.xml + - abusers-ipv6.xml + notify: + - reload firewalld tags: firewall # vim: set sw=2 ts=2: