ansible-role-fail2ban's Introduction

Ansible Role: Install Fail2Ban

Installs Fail2Ban from source on Debian/Ubuntu linux servers.

Requirements

None

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

fail2ban_download_url: 'https://github.com/fail2ban/fail2ban/archive/0.9.3.tar.gz'
fail2ban_workspace: '/opt'

fail2ban_jail_dir: '/etc/fail2ban/jail.d'

fail2ban_apt_packages:
  - whois
  - iptables-persistent

Dependencies

None.

Installation

$ ansible-galaxy install tschifftner.fail2ban

Example Playbook

- hosts: server

  vars:
    # Ignore all own ips
    fail2ban_ignoreip: "{{ ansible_all_ipv4_addresses }}"
      
    fail2ban_jails:
      - name: 'ssh'
        enabled: true
        port: ssh
        filter: sshd
        logpath: /var/log/auth.log
        maxretry: 3
    
      - name: 'ssh-ddos'
        enabled: true
        port: ssh
        bantime: 86400
        filter: 'sshd-ddos'
        logpath: /var/log/auth.log
        maxretry: 6

  roles:
    - { role: tschifftner.fail2ban }

Supported OS

Debian 9 (Stretch)
Debian 8 (Jessie)
Ubuntu 18.04 (Bionic Beaver)
Ubuntu 16.04 (Xenial Xerus)

Required ansible version

Ansible 2.5+

License

MIT License

Author Information

Tobias Schifftner, ambimax® GmbH

ansible-role-fail2ban's People

Contributors

Stargazers

Watchers

ansible-role-fail2ban's Issues

How use tags?

I wrote tags only config - { role: tschifftner.ansible-role-fail2ban, tags: ['fail2ban-configure'] }, but it run all... Could you say, what I do wrong?
My playbook:

- hosts: prod
  become: yes
  become_method: sudo
  vars:
    fail2ban_jails:
      - name: 'ssh'
        enabled: true
        port: ssh
        filter: sshd
        logpath: /var/log/auth.log
        bantime: 86400 # 1 day
        maxretry: 2
        action: iptables-multiport
      - name: 'ssh-ddos'
        enabled: true
        port: ssh
        bantime: 86400
        filter: 'sshd-ddos'
        logpath: /var/log/auth.log
        maxretry: 6
        action: iptables-multiport
  roles:
    - { role: tschifftner.ansible-role-fail2ban, tags: ['fail2ban-configure'] }