https://github.com/programmfabrik/role-fail2ban
Ansible play to install and configure fail2ban
https://github.com/programmfabrik/role-fail2ban
Last synced: 5 months ago
JSON representation
Ansible play to install and configure fail2ban
- Host: GitHub
- URL: https://github.com/programmfabrik/role-fail2ban
- Owner: programmfabrik
- License: apache-2.0
- Created: 2019-05-31T13:46:22.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2024-02-29T13:52:38.000Z (over 2 years ago)
- Last Synced: 2025-09-20T13:13:12.711Z (9 months ago)
- Language: Jinja
- Homepage:
- Size: 30.3 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Ansible Role fail2ban
This role installs and configures fail2ban.
## Example play
```yaml
- hosts: all
roles:
- blunix.role-fail2ban
vars:
fail2ban_enabled: yes
fail2ban_default_bantime: 3600
fail2ban_default_maxretry: 5
fail2ban_default_destemail: monitoring-example@example.com
fail2ban_jails:
- name: default
vars:
DEFAULT:
ignoreip: '8.8.4.4'
backend: auto
banaction: iptables-multiport
- name: sshd
vars:
sshd:
enabled: 'true'
filter: sshd
maxretry: 6
port: ssh
sshd_ddos:
action:
- 'shorewall[name=SSH, port=ssh, protocol=tcp]'
enabled: 'true'
filter: 'sshd-ddos'
maxretry: 6
port: ssh
fail2ban_actions:
- name: 'iptables-ipset-proto4'
vars:
INCLUDES:
before: iptables-blocktype.conf
Definition:
actionstart:
- 'ipset --create fail2ban- iphash'
- 'iptables -I INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j '
actionstop:
- 'iptables -D INPUT -p -m multiport --dports -m set --match-set fail2ban- src -j '
- 'ipset --flush fail2ban-'
- 'ipset --destroy fail2ban-'
actionban:
- 'ipset --test fail2ban- || ipset --add fail2ban- '
actionunban:
- 'ipset --test fail2ban- && ipset --del fail2ban- '
Init:
name: default
port: ssh
protocol: tcp
fail2ban_filters:
download:
- name: apache-common-latest
url: "https://raw.githubusercontent.com/fail2ban/fail2ban/0.10/config/filter.d/apache-common.conf"
custom:
- name: nginx-noscript
vars:
Definition:
failregex: |
.*(GET|POST).*(\.php|\.asp|\.exe|\.pl|\.cgi|\.scgi).*
- name: nginx-reqlimit
vars:
Definition:
failregex: |
limiting requests, excess:.* by zone.*client:
# From https://github.com/fail2ban/fail2ban/blob/0.8/config/filter.d/apache-common.conf
- name: apache-common-latest
vars:
INCLUDES:
after: apache-common-latest.local
DEFAULT:
_apache_error_client: |
\[[^]]*\] \[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])? \[client (:\d{1,5})?\]
# From https://github.com/fail2ban/fail2ban/blob/0.8/config/filter.d/apache-auth.conf
- name: apache-auth-latest
vars:
INCLUDES:
before: apache-common-latest.conf
Definition:
ignoreregex: ''
failregex: |
^%(_apache_error_client)s (AH01797: )?client denied by server configuration: (uri )?\S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01617: )?user .*? authentication failure for "\S*": Password Mismatch(, referer: \S+)?$
^%(_apache_error_client)s (AH01618: )?user .*? not found(: )?\S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01614: )?client used wrong authentication scheme: \S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH\d+: )?Authorization of user \S+ to access \S* failed, reason: .*$
^%(_apache_error_client)s (AH0179[24]: )?(Digest: )?user .*?: password mismatch: \S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH0179[01]: |Digest: )user `.*?' in realm `.+' (not found|denied by provider): \S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01631: )?user .*?: authorization failure for "\S*":(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01775: )?(Digest: )?invalid nonce .* received - length is not \S+(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01788: )?(Digest: )?realm mismatch - got `.*?' but expected `.+'(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01789: )?(Digest: )?unknown algorithm `.*?' received: \S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01793: )?invalid qop `.*?' received: \S*(, referer: \S+)?\s*$
^%(_apache_error_client)s (AH01777: )?(Digest: )?invalid nonce .*? received - user attempted time travel(, referer: \S+)?\s*$
# From http://www.fail2ban.org/wiki/index.php/HOWTO_fail2ban_with_OpenVPN
- name: openvpn
vars:
Definition:
ignoreregex: ''
failregex: |
^ TLS Error: incoming packet authentication failed from \[AF_INET\]:\d+$
^ :\d+ Connection reset, restarting
^ :\d+ TLS Auth Error
^ :\d+ TLS Error: TLS handshake failed$
^ :\d+ VERIFY ERROR
```
# License
Apache-2.0
# Author Information
All changes from 2019-05-31 onwards:
```
Programmfabrik GmbH,
Schwedter Str. 9b,
10119 Berlin
```
All changes until 2019-05-30 by:
Service and support for orchestrated hosting environments,
continuous integration/deployment/delivery and various Linux
and open-source technology stacks are available from:
```
Blunix GmbH - Consulting for Linux Hosting 24/7
Glogauer Straße 21
10999 Berlin - Germany
Web: www.blunix.org
Email: service[at]blunix.org
Phone: (+49) 30 / 12 08 39 90
```