Skip to content

Commit 884c630

Browse files
pjanpjan
committed
Initial commit
0 parents  commit 884c630

12 files changed

+499
-0
lines changed

‎.gitignore

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.DS_Store
2+
.AppleDouble
3+
.LSOverride
4+
Icon
5+
._*
6+
.Spotlight-V100
7+
.Trashes
8+
.vagrant
9+
test

‎.travis.yml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
language: python
3+
python: "2.7"
4+
before_install:
5+
- sudo apt-get update -qq
6+
- sudo apt-get install -qq python-apt python-pycurl
7+
install:
8+
- pip install ansible==1.5.0
9+
script:
10+
- echo localhost > inventory
11+
- ansible-playbook --syntax-check -i inventory test.yml
12+
- ansible-playbook -i inventory test.yml --connection=local --sudo

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
The MIT License
2+
3+
Copyright (c) 2014 Pieterjan Vandaele
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in
13+
all copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21+
THE SOFTWARE.

‎README.md

+54
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
## Ansibles - fail2ban [![Build Status](https://travis-ci.org/Ansibles/fail2ban.png)](https://travis-ci.org/Ansibles/fail2ban)
2+
3+
Ansible role which installs and configures fail2ban, a utility that watches logs for failed login attempts and blocks repeat offenders with firewall rules.
4+
5+
6+
#### Requirements & Dependencies
7+
- Tested on Ansible 1.4 or higher.
8+
9+
10+
#### Variables
11+
12+
- `fail2ban_loglevel` - sets the loglevel output (1 = ERROR, 2 = WARN, 3 = INFO, 4 = DEBUG; default is 3)
13+
- `fail2ban_logtarget1` - set the log target. This could be a file, SYSLOG, STDERR or STDOUT
14+
- `fail2ban_syslog_target`
15+
- `fail2ban_syslog_facility`
16+
- `fail2ban_socket` - sets the socket file, which is used to communicate with the daemon
17+
18+
- `fail2ban_ignoreip` - which IP address/CIDR mask/DNS host should be ignored from fail2ban's actions
19+
- `fail2ban_bantime` - sets the bantime
20+
- `fail2ban_maxretry` - maximum number of retries before the host is put into jail
21+
- `fail2ban_backend` - specifies the backend used to get files modification
22+
- `fail2ban_email` - email address which can be used in the interpolation of the `fail2ban_services`
23+
- `fail2ban_banaction` - sets the global/default banaction (can be overriden on a per role basis)
24+
- `fail2ban_mta` - email action
25+
- `fail2ban_protocol` - sets the default protocol
26+
- `fail2ban_chain` - specifies the chain where jumps would need to be added in iptables-* actions
27+
- `fail2ban_action` - default action
28+
29+
For each of the services you wish to protect/put a jail or ban up for, you need to add it to the `fail2ban_services` list of hashes:
30+
31+
```yaml
32+
fail2ban_services:
33+
- name: ssh
34+
enabled: true
35+
port: ssh
36+
filter: sshd
37+
logpath: /var/log/auth.log
38+
maxretry: 6
39+
protocol: tcp (optional)
40+
action: action_ (optional)
41+
banaction: "iptables-multiport" (optional)
42+
```
43+
44+
There's a list of [service examples](services_examples.md) to help you.
45+
46+
47+
#### License
48+
49+
Licensed under the MIT License. See the LICENSE file for details.
50+
51+
52+
#### Feedback, bug-reports, requests, ...
53+
54+
Are [welcome](https://github.com/ansibles/fail2ban/issues)!

‎defaults/main.yml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# file: fail2ban/defaults/main.yml
2+
3+
fail2ban_loglevel: 3
4+
fail2ban_logtarget: "/var/log/fail2ban.log"
5+
fail2ban_syslog_target: "/var/log/fail2ban.log"
6+
fail2ban_syslog_facility: 1
7+
fail2ban_socket: /var/run/fail2ban/fail2ban.sock
8+
9+
fail2ban_ignoreip: "127.0.0.1/8"
10+
fail2ban_bantime: 600
11+
fail2ban_maxretry: 3
12+
fail2ban_backend: "auto"
13+
fail2ban_destemail: "root@localhost"
14+
fail2ban_banaction: "iptables-multiport"
15+
fail2ban_mta: "sendmail"
16+
fail2ban_protocol: "tcp"
17+
fail2ban_chain: "INPUT"
18+
fail2ban_action: "action_"
19+
20+
fail2ban_auth_log: "/var/log/auth.log"
21+
22+
fail2ban_services:
23+
- name: ssh
24+
enabled: true
25+
port: ssh
26+
filter: sshd
27+
logpath: /var/log/auth.log
28+
maxretry: 6

‎handlers/main.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# file: fail2ban/handlers/main.yml
2+
3+
- name: restart fail2ban
4+
service:
5+
name: fail2ban
6+
state: restarted

‎meta/main.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# file: fail2ban/meta/main.yml
2+
3+
galaxy_info:
4+
author: pjan vandaele
5+
company: Ansibles
6+
description:
7+
min_ansible_version: 1.4
8+
license: MIT
9+
platforms:
10+
- name: Ubuntu
11+
versions:
12+
- all
13+
categories:
14+
- system
15+
16+
dependencies: []

‎services_examples.md

+167
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
### Ansibles - fail2ban: List of service examples
2+
3+
###### ssh/dropbear/...
4+
```yaml
5+
- name: ssh
6+
enabled: true
7+
port: ssh
8+
filter: sshd
9+
logpath: /var/log/auth.log
10+
```
11+
12+
###### Generic filter for pam
13+
```yaml
14+
fail2ban_services:
15+
- name: pam-generic
16+
enabled: true
17+
port: all
18+
filter: pam-generic
19+
logpath: /var/log/auth.log
20+
maxretry: 6
21+
banaction: iptables-allports
22+
```
23+
24+
###### xinetd-fail
25+
```yaml
26+
fail2ban_services:
27+
- name: xinetd-fail
28+
enabled: true
29+
port: all
30+
filter: xinetd-fail
31+
logpath: /var/log/daemon.log
32+
maxretry: 2
33+
banaction: iptables-multiport-log
34+
```
35+
36+
###### ssh-ddos
37+
```yaml
38+
fail2ban_services:
39+
- name: ssh-ddos
40+
enabled: true
41+
port: ssh
42+
filter: ssh-ddos
43+
logpath: /var/log/auth.log
44+
maxretry: 6
45+
```
46+
47+
###### apache
48+
```yaml
49+
fail2ban_services:
50+
- name: apache
51+
enabled: true
52+
port: http,https
53+
filter: apache-auth
54+
logpath: /var/log/apache*/*error.log
55+
maxretry: 6
56+
```
57+
58+
###### apache-multiport
59+
```yaml
60+
fail2ban_services:
61+
- name: apache-multiport
62+
enabled: true
63+
port: http,https
64+
filter: apache-auth
65+
logpath: /var/log/apache*/*error.log
66+
maxretry: 6
67+
banaction:
68+
```
69+
70+
###### apache-noscript
71+
```yaml
72+
fail2ban_services:
73+
- name: apache-noscript
74+
enabled: true
75+
port: http,https
76+
filter: apache-noscript
77+
logpath: /var/log/apache*/*error.log
78+
maxretry: 6
79+
```
80+
81+
###### apache-overflows
82+
```yaml
83+
fail2ban_services:
84+
- name: apache-overflows
85+
enabled: true
86+
port: http,https
87+
filter: apache-overflows
88+
logpath: /var/log/apache*/*error.log
89+
maxretry: 2
90+
```
91+
92+
###### vsftpd
93+
```yaml
94+
fail2ban_services:
95+
- name: vsftpd
96+
enabled: true
97+
port: ftp,ftp-data,ftps,ftps-data
98+
filter: vsftpd
99+
logpath: /var/log/vsftpd.log
100+
maxretry: 6
101+
```
102+
103+
###### proftpd
104+
```yaml
105+
fail2ban_services:
106+
- name: proftpd
107+
enabled: true
108+
port: ftp,ftp-data,ftps,ftps-data
109+
filter: proftpd
110+
logpath: /var/log/proftpd/proftpd.log
111+
maxretry: 6
112+
```
113+
114+
###### postfix
115+
```yaml
116+
fail2ban_services:
117+
- name: postfix
118+
enabled: true
119+
port: smtp, ssmtp
120+
filter: postfix
121+
logpath: /var/log/mail.log
122+
maxretry: 6
123+
```
124+
125+
###### couriersmtp
126+
```yaml
127+
fail2ban_services:
128+
- name: couriersmtp
129+
enabled: true
130+
port: smtp,ssmtp
131+
filter: couriersmtp
132+
logpath: /var/log/mail.log
133+
maxretry: 6
134+
```
135+
136+
###### courierauth
137+
```yaml
138+
fail2ban_services:
139+
- name: courierauth
140+
enabled: true
141+
port: smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
142+
filter: courierlogin
143+
logpath: /var/log/mail.log
144+
maxretry: 6
145+
```
146+
147+
###### sasl
148+
```yaml
149+
fail2ban_services:
150+
- name: sasl
151+
enabled: true
152+
port: smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
153+
filter: sasl
154+
logpath: /var/log/mail.log
155+
maxretry: 6
156+
```
157+
158+
###### dovecot
159+
```yaml
160+
fail2ban_services:
161+
- name: dovecot
162+
enabled: true
163+
port: smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
164+
filter: dovecot
165+
logpath: /var/log/mail.log
166+
maxretry: 6
167+
```

‎tasks/main.yml

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# file: fail2ban/tasks/main.yml
2+
3+
- name: fail2ban | Make sure fail2ban is installed
4+
apt:
5+
pkg: fail2ban
6+
state: latest
7+
8+
- name: fail2ban | Make sure the fail2ban configuration is up to date
9+
template:
10+
src: etc_fail2ban_fail2ban.conf.j2
11+
dest: /etc/fail2ban/fail2ban.conf
12+
owner: root
13+
group: root
14+
mode: 0644
15+
notify:
16+
- restart fail2ban
17+
18+
- name: fail2ban | Make sure the fail2ban jail configuration is up to date
19+
template:
20+
src: etc_fail2ban_jail.conf.j2
21+
dest: /etc/fail2ban/jail.conf
22+
owner: root
23+
group: root
24+
mode: 0644
25+
notify:
26+
- restart fail2ban
27+
28+
- name: fail2ban | Make sure fail2ban is enabled
29+
service:
30+
name: fail2ban
31+
enabled: yes

‎templates/etc_fail2ban_fail2ban.conf.j2

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Fail2Ban configuration file
2+
#
3+
# Author: Cyril Jaquier
4+
#
5+
# $Revision$
6+
#
7+
8+
[Definition]
9+
10+
# Option: loglevel
11+
# Notes.: Set the log level output.
12+
# 1 = ERROR
13+
# 2 = WARN
14+
# 3 = INFO
15+
# 4 = DEBUG
16+
# Values: NUM Default: 3
17+
#
18+
loglevel = {{fail2ban_loglevel}}
19+
20+
# Option: logtarget
21+
# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
22+
# Only one log target can be specified.
23+
# Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log
24+
#
25+
logtarget = {{fail2ban_logtarget}}
26+
{% if fail2ban_logtarget == "SYSLOG" %}
27+
syslog-target = {{fail2ban_syslog_target}}
28+
syslog-facility = {{fail2ban_syslog_facility}}
29+
{% endif %}
30+
31+
# Option: socket
32+
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
33+
# not remove this file when Fail2ban runs. It will not be possible to
34+
# communicate with the server afterwards.
35+
# Values: FILE Default: /var/run/fail2ban/fail2ban.sock
36+
#
37+
socket = {{fail2ban_socket}}
38+

0 commit comments

Comments
 (0)