Alan Orth
7a9a24ef5d
Actually, we do want to run fail2ban on all hosts because the sshd monitoring via systemd is nice. At the very least it reduces spam from failed logins in our systemd journal.
115 lines
3.4 KiB
YAML
115 lines
3.4 KiB
YAML
---
|
|
# Ubuntu 20.04 will use nftables directly, with no firewalld.
|
|
|
|
- block:
|
|
- name: Install Ubuntu firewall packages
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.package:
|
|
name:
|
|
- libnet-ip-perl # for aggregate-cidr-addresses.pl
|
|
- nftables
|
|
- curl # for nftables update scripts
|
|
state: present
|
|
cache_valid_time: 3600
|
|
|
|
- name: Remove ufw
|
|
ansible.builtin.package:
|
|
name: ufw
|
|
state: absent
|
|
|
|
- name: Copy nftables.conf
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.template:
|
|
src: nftables.conf.j2
|
|
dest: /etc/nftables.conf
|
|
owner: root
|
|
mode: "0644"
|
|
notify:
|
|
- restart nftables
|
|
- restart fail2ban
|
|
|
|
- name: Create /etc/nftables extra config directory
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.file:
|
|
path: /etc/nftables
|
|
state: directory
|
|
owner: root
|
|
mode: "0755"
|
|
|
|
- name: Copy extra nftables configuration files
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.copy:
|
|
src: "{{ item.src }}"
|
|
dest: /etc/nftables/{{ item.src }}
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
force: "{{ item.force }}"
|
|
loop:
|
|
- { src: spamhaus-ipv4.nft, force: "no" }
|
|
- { src: spamhaus-ipv6.nft, force: "no" }
|
|
- { src: abusech-ipv4.nft, force: "no" }
|
|
- { src: abuseipdb-ipv4.nft, force: "yes" }
|
|
- { src: abuseipdb-ipv6.nft, force: "yes" }
|
|
notify:
|
|
- restart nftables
|
|
- restart fail2ban
|
|
|
|
- name: Copy nftables update scripts
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: /usr/local/bin/{{ item }}
|
|
mode: "0755"
|
|
owner: root
|
|
group: root
|
|
loop:
|
|
- update-spamhaus-nftables.sh
|
|
- aggregate-cidr-addresses.pl
|
|
- update-abusech-nftables.sh
|
|
|
|
- name: Copy nftables systemd units
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.copy:
|
|
src: "{{ item }}"
|
|
dest: /etc/systemd/system/{{ item }}
|
|
mode: "0644"
|
|
owner: root
|
|
group: root
|
|
loop:
|
|
- update-spamhaus-nftables.service
|
|
- update-spamhaus-nftables.timer
|
|
- update-abusech-nftables.service
|
|
- update-abusech-nftables.timer
|
|
register: nftables_systemd_units
|
|
|
|
# need to reload to pick up service/timer/environment changes
|
|
- name: Reload systemd daemon
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: nftables_systemd_units is changed
|
|
|
|
- name: Start and enable nftables update timers
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
state: started
|
|
enabled: true
|
|
loop:
|
|
- update-spamhaus-nftables.timer
|
|
- update-abusech-nftables.timer
|
|
|
|
- name: Start and enable nftables
|
|
when: ansible_distribution_version is version('20.04', '>=')
|
|
ansible.builtin.systemd:
|
|
name: nftables
|
|
state: started
|
|
enabled: true
|
|
|
|
- ansible.builtin.include_tasks: fail2ban.yml
|
|
when:
|
|
- ansible_distribution_version is version('16.04', '>=')
|
|
tags: firewall
|
|
|
|
# vim: set sw=2 ts=2:
|