Alan Orth
7a9a24ef5d
Actually, we do want to run fail2ban on all hosts because the sshd monitoring via systemd is nice. At the very least it reduces spam from failed logins in our systemd journal.
57 lines
1.5 KiB
YAML
57 lines
1.5 KiB
YAML
---
|
|
- name: Install fail2ban
|
|
when:
|
|
- ansible_distribution_major_version is version('11', '>=')
|
|
ansible.builtin.package:
|
|
name:
|
|
- fail2ban
|
|
- python3-systemd
|
|
state: present
|
|
cache_valid_time: 3600
|
|
|
|
- name: Configure fail2ban sshd filter
|
|
ansible.builtin.template:
|
|
src: etc/fail2ban/jail.d/sshd.local.j2
|
|
dest: /etc/fail2ban/jail.d/sshd.local
|
|
owner: root
|
|
mode: "0644"
|
|
notify: restart fail2ban
|
|
|
|
- name: Configure fail2ban nginx filter
|
|
when:
|
|
- webserver is defined and webserver == 'nginx'
|
|
- extra_fail2ban_filters is defined
|
|
- "'nginx' in extra_fail2ban_filters"
|
|
ansible.builtin.template:
|
|
src: etc/fail2ban/jail.d/nginx.local.j2
|
|
dest: /etc/fail2ban/jail.d/nginx.local
|
|
owner: root
|
|
mode: "0644"
|
|
notify: restart fail2ban
|
|
|
|
- name: Create fail2ban service override directory
|
|
ansible.builtin.file:
|
|
path: /etc/systemd/system/fail2ban.service.d
|
|
state: directory
|
|
owner: root
|
|
mode: "0755"
|
|
|
|
# See Arch Linux's example: https://wiki.archlinux.org/index.php/Fail2ban
|
|
- name: Configure fail2ban service override
|
|
ansible.builtin.template:
|
|
src: etc/systemd/system/fail2ban.service.d/override.conf.j2
|
|
dest: /etc/systemd/system/fail2ban.service.d/override.conf
|
|
owner: root
|
|
mode: "0644"
|
|
notify:
|
|
- reload systemd
|
|
- restart fail2ban
|
|
|
|
- name: Start and enable fail2ban service
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|
|
|
|
# vim: set sw=2 ts=2:
|