parent
82a40dc503
commit
71683e86eb
@ -0,0 +1,3 @@
|
||||
# ---> Ansible
|
||||
*.retry
|
||||
|
||||
@ -0,0 +1,24 @@
|
||||
common_development: false
|
||||
|
||||
# common_fail2ban.conf
|
||||
|
||||
common_fail2ban_loglevel: INFO
|
||||
common_fail2ban_logtarget: /var/log/common_fail2ban.log
|
||||
common_fail2ban_syslog_socket: auto
|
||||
common_fail2ban_dbpurgeage: 1d
|
||||
common_fail2ban_dbmaxmatches: 10
|
||||
|
||||
# jail.conf
|
||||
|
||||
common_fail2ban_ignoreself: "true"
|
||||
common_fail2ban_ignoreips:
|
||||
- 127.0.0.1/8
|
||||
- ::1
|
||||
|
||||
common_fail2ban_findtime: 600
|
||||
common_fail2ban_maxretry: 5
|
||||
common_fail2ban_bantime: 600
|
||||
common_fail2ban_protocol: "tcp"
|
||||
|
||||
common_fail2ban_jails:
|
||||
- ssh.conf
|
||||
@ -0,0 +1,12 @@
|
||||
#
|
||||
# handlers: main
|
||||
#
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
- name: restart fail2ban
|
||||
service:
|
||||
name: fail2ban
|
||||
enabled: yes
|
||||
state: restarted
|
||||
@ -0,0 +1,17 @@
|
||||
#
|
||||
# playbook: configure
|
||||
#
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
- name: Install
|
||||
hosts: all
|
||||
become: yes
|
||||
roles:
|
||||
- common
|
||||
|
||||
tasks:
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: configure-fail2ban.yml
|
||||
@ -0,0 +1,21 @@
|
||||
#
|
||||
# playbook: install basic stuff
|
||||
#
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
- name: Install
|
||||
hosts: all
|
||||
become: yes
|
||||
roles:
|
||||
- common
|
||||
|
||||
tasks:
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: install.yml
|
||||
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: deployer.yml
|
||||
@ -0,0 +1,18 @@
|
||||
#
|
||||
# playbook: update
|
||||
#
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
- name: Update Server
|
||||
hosts: all
|
||||
become: yes
|
||||
|
||||
roles:
|
||||
- common
|
||||
|
||||
tasks:
|
||||
- include_role:
|
||||
name: common
|
||||
tasks_from: update.yml
|
||||
@ -0,0 +1,21 @@
|
||||
# Generic configuration file for -botsearch filters
|
||||
#
|
||||
# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
|
||||
#
|
||||
|
||||
[Init]
|
||||
|
||||
# Block is the actual non-found directories to block
|
||||
block = \/?(<webmail>|<phpmyadmin>|<wordpress>|cgi-bin|mysqladmin)[^,]*
|
||||
|
||||
# These are just convenient definitions that assist the blocking of stuff that
|
||||
# isn't installed
|
||||
|
||||
webmail = roundcube|(ext)?mail|horde|(v-?)?webmail
|
||||
phpmyadmin = (typo3/|xampp/|admin/|)(pma|(php)?[Mm]y[Aa]dmin)
|
||||
wordpress = wp-(login|signup|admin)\.php
|
||||
|
||||
# DEV Notes:
|
||||
# Taken from apache-botsearch filter
|
||||
#
|
||||
# Author: Frantisek Sumsal
|
||||
@ -0,0 +1,9 @@
|
||||
# block
|
||||
#
|
||||
# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^<HOST>.*"(GET|PUT|POST).*" (403) .*$
|
||||
ignoreregex = .*(robots.txt|favicon.ico|css|htc|js|asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|json|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|otf|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|tif|tiff|ttf|ttc|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip)
|
||||
@ -0,0 +1,20 @@
|
||||
# Fail2Ban filter to match web requests for selected URLs that don't exist
|
||||
# Based on apache-botsearch filter
|
||||
#
|
||||
# Author: Frantisek Sumsal
|
||||
#
|
||||
# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# Load regexes for filtering
|
||||
before = botsearch-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = ^<HOST> \- \S+ \[\] \"(GET|POST|HEAD) \/<block> \S+\" 404 .+$
|
||||
^ \[error\] \d+#\d+: \*\d+ (\S+ )?\"\S+\" (failed|is not found) \(2\: No such file or directory\), client\: <HOST>\, server\: \S*\, request: \"(GET|POST|HEAD) \/<block> \S+\"\, .*?$
|
||||
ignoreregex =
|
||||
datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
|
||||
^[^\[]*\[({DATE})
|
||||
{^LN-BEG}
|
||||
@ -0,0 +1,31 @@
|
||||
# Generic nginx error_log configuration items (to be used as interpolations) in other
|
||||
# filters monitoring nginx error-logs
|
||||
#
|
||||
# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
|
||||
|
||||
[DEFAULT]
|
||||
|
||||
# Type of log-file resp. log-format (file, short, journal):
|
||||
logtype = file
|
||||
|
||||
# Daemon definition is to be specialized (if needed) in .conf file
|
||||
_daemon = nginx
|
||||
|
||||
# Common line prefixes (beginnings) which could be used in filters
|
||||
#
|
||||
# [bsdverbose]? [hostname] [vserver tag] daemon_id spaces
|
||||
#
|
||||
# This can be optional (for instance if we match named native log files)
|
||||
|
||||
__prefix = <lt_<logtype>/__prefix>
|
||||
__err_type = error
|
||||
__prefix_line = %(__prefix)s\[%(__err_type)s\] \d+#\d+: \*\d+\s+
|
||||
|
||||
[lt_file]
|
||||
__prefix = \s*
|
||||
|
||||
[lt_short]
|
||||
__prefix = \s*(?:(?!\[)\S+ %(_daemon)s\[\d+\]: [^\[]*)?
|
||||
|
||||
[lt_journal]
|
||||
__prefix = %(lt_short/__prefix)s
|
||||
@ -0,0 +1,9 @@
|
||||
# targets attempts to access forbidden directories
|
||||
#
|
||||
# @source https://scalastic.io/en/ufw-fail2ban-nginx/#step-4-configuring-fail2bans-basic-rules
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = directory index of .+ is forbidden, client: <HOST>, server: .+
|
||||
ignoreregex =
|
||||
@ -0,0 +1,44 @@
|
||||
# Blocking auth
|
||||
#
|
||||
# @source https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/nginx-http-auth.conf
|
||||
#
|
||||
|
||||
# fail2ban filter configuration for nginx
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
before = nginx-error-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
mode = normal
|
||||
|
||||
__err_type = <_ertp-<mode>>
|
||||
|
||||
_ertp-auth = error
|
||||
mdre-auth = ^%(__prefix_line)suser "(?:[^"]+|.*?)":? (?:password mismatch|was not found in "[^\"]*"), client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(?:, referrer: "\S+")?\s*$
|
||||
_ertp-fallback = crit
|
||||
mdre-fallback = ^%(__prefix_line)sSSL_do_handshake\(\) failed \(SSL: error:\S+(?: \S+){1,3} too (?:long|short)\)[^,]*, client: <HOST>
|
||||
|
||||
_ertp-normal = %(_ertp-auth)s
|
||||
mdre-normal = %(mdre-auth)s
|
||||
_ertp-aggressive = (?:%(_ertp-auth)s|%(_ertp-fallback)s)
|
||||
mdre-aggressive = %(mdre-auth)s
|
||||
%(mdre-fallback)s
|
||||
|
||||
failregex = <mdre-<mode>>
|
||||
ignoreregex =
|
||||
datepattern = {^LN-BEG}
|
||||
journalmatch = _SYSTEMD_UNIT=nginx.service + _COMM=nginx
|
||||
|
||||
# DEV NOTES:
|
||||
# mdre-auth:
|
||||
# Based on samples in https://github.com/fail2ban/fail2ban/pull/43/files
|
||||
# Extensive search of all nginx auth failures not done yet.
|
||||
#
|
||||
# Author: Daniel Black
|
||||
|
||||
# mdre-fallback:
|
||||
# Ban people checking for TLS_FALLBACK_SCSV repeatedly
|
||||
# https://stackoverflow.com/questions/28010492/nginx-critical-error-with-ssl-handshaking/28010608#28010608
|
||||
# Author: Stephan Orlowsky
|
||||
@ -0,0 +1,46 @@
|
||||
# Fail2ban filter configuration for nginx :: limit_req
|
||||
# used to ban hosts, that were failed through nginx by limit request processing rate
|
||||
#
|
||||
# Author: Serg G. Brester (sebres)
|
||||
#
|
||||
# To use 'nginx-limit-req' filter you should have `ngx_http_limit_req_module`
|
||||
# and define `limit_req` and `limit_req_zone` as described in nginx documentation
|
||||
# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# http {
|
||||
# ...
|
||||
# limit_req_zone $binary_remote_addr zone=lr_zone:10m rate=1r/s;
|
||||
# ...
|
||||
# # http, server, or location:
|
||||
# location ... {
|
||||
# limit_req zone=lr_zone burst=1 nodelay;
|
||||
# ...
|
||||
# }
|
||||
# ...
|
||||
# }
|
||||
# ...
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
# Specify following expression to define exact zones, if you want to ban IPs limited
|
||||
# from specified zones only.
|
||||
# Example:
|
||||
#
|
||||
# ngx_limit_req_zones = lr_zone|lr_zone2
|
||||
#
|
||||
ngx_limit_req_zones = [^"]+
|
||||
|
||||
# Use following full expression if you should range limit request to specified
|
||||
# servers, requests, referrers etc. only :
|
||||
#
|
||||
# failregex = ^\s*\[[a-z]+\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>, server: \S*, request: "\S+ \S+ HTTP/\d+\.\d+", host: "\S+"(, referrer: "\S+")?\s*$
|
||||
|
||||
# Shortly, much faster and stable version of regexp:
|
||||
failregex = ^\s*\[[a-z]+\] \d+#\d+: \*\d+ limiting requests, excess: [\d\.]+ by zone "(?:%(ngx_limit_req_zones)s)", client: <HOST>,
|
||||
|
||||
ignoreregex =
|
||||
|
||||
datepattern = {^LN-BEG}
|
||||
@ -0,0 +1,19 @@
|
||||
#
|
||||
# nginx-noscript
|
||||
#
|
||||
#
|
||||
|
||||
[INCLUDES]
|
||||
|
||||
# overwrite with apache-common.local if _apache_error_client is incorrect.
|
||||
before = apache-common.conf
|
||||
|
||||
[Definition]
|
||||
|
||||
script = /\S*(?:php(?:[45]|[.-]cgi)?|\.asp|\.exe|\.pl|\bcgi-bin/)
|
||||
|
||||
prefregex = ^%(_apache_error_client)s (?:AH0(?:01(?:28|30)|1(?:264|071)|2811): )?(?:(?:[Ff]ile|script|[Gg]ot) )<F-CONTENT>.+</F-CONTENT>$
|
||||
|
||||
failregex = ^(?:does not exist|not found or unable to stat): <script>\b
|
||||
^'<script>\S*' not found or unable to stat
|
||||
\[error\].+"[Pp]rimary script unknown"(?:\\n)?
|
||||
@ -0,0 +1,11 @@
|
||||
# protects against SSL handshake failure attacks
|
||||
#
|
||||
#
|
||||
|
||||
[Definition]
|
||||
|
||||
failregex = SSL_do_handshake\(\) failed .+ while SSL handshaking, client: <HOST>, server: .+
|
||||
ignoreregex =
|
||||
datepattern = {^LN-BEG}%%ExY(?P<_sep>[-/.])%%m(?P=_sep)%%d[T ]%%H:%%M:%%S(?:[.,]%%f)?(?:\s*%%z)?
|
||||
^[^\[]*\[({DATE})
|
||||
{^LN-BEG}
|
||||
@ -0,0 +1,8 @@
|
||||
# wordpress login failed
|
||||
|
||||
[INCLUDES]
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
failregex = <HOST>.*POST.*(wp-login\.php|xmlrpc\.php).* 200
|
||||
ignoreregex =
|
||||
@ -0,0 +1,4 @@
|
||||
# wordpress cron
|
||||
|
||||
[Definition]
|
||||
failregex = ^<HOST> .*POST .*wp-cron\.php.*
|
||||
@ -0,0 +1,8 @@
|
||||
# wordpress xmlrpc
|
||||
|
||||
[INCLUDES]
|
||||
before = common.conf
|
||||
|
||||
[Definition]
|
||||
failregex = <HOST>.*(xmlrpc\.php).* 403
|
||||
ignoreregex =
|
||||
@ -0,0 +1,8 @@
|
||||
[mysqld-auth]
|
||||
enabled = true
|
||||
port = 3306
|
||||
filter = mysqld-auth
|
||||
logpath = /var/log/mysql/error.log
|
||||
findtime = 3600
|
||||
maxretry = 5
|
||||
bantime = 86400
|
||||
@ -0,0 +1,9 @@
|
||||
# stop some known malicious bot request patterns
|
||||
|
||||
[nginx-badbots]
|
||||
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = apache-badbots
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 2
|
||||
@ -0,0 +1,7 @@
|
||||
[nginx-botsearch]
|
||||
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-botsearch
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 2
|
||||
@ -0,0 +1,9 @@
|
||||
# ban clients that are searching for scripts on the website to execute and exploit,
|
||||
# only using if php not in use
|
||||
|
||||
[nginx-http-auth]
|
||||
|
||||
enabled = true
|
||||
filter = nginx-http-auth
|
||||
port = http,https
|
||||
logpath = /var/log/nginx/*error.log
|
||||
@ -0,0 +1,10 @@
|
||||
# dos
|
||||
|
||||
[nginx-req-limit]
|
||||
|
||||
enabled = true
|
||||
filter = nginx-limit-req
|
||||
logpath = /var/log/nginx/*error.log
|
||||
findtime = 600
|
||||
bantime = 7200
|
||||
maxretry = 10
|
||||
@ -0,0 +1,7 @@
|
||||
[nginx-nohome]
|
||||
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = apache-nohome
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 2
|
||||
@ -0,0 +1,7 @@
|
||||
[nginx-noscript]
|
||||
|
||||
enabled = true
|
||||
port = http,https
|
||||
filter = nginx-noscript
|
||||
logpath = /var/log/nginx/*error.log
|
||||
maxretry = 2
|
||||
@ -0,0 +1,5 @@
|
||||
[ssh]
|
||||
enabled = true
|
||||
port = ssh
|
||||
filter = sshd
|
||||
logpath = /var/log/auth.log
|
||||
@ -0,0 +1,7 @@
|
||||
[wordpress-auth]
|
||||
enabled = true
|
||||
filter = wordpress-auth
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 5
|
||||
bantime = 1 day
|
||||
datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
|
||||
@ -0,0 +1,7 @@
|
||||
[wordpress-cron]
|
||||
enabled = true
|
||||
filter = wordpress-cron
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 5
|
||||
bantime = 1 day
|
||||
datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
|
||||
@ -0,0 +1,7 @@
|
||||
[wordpress-xmlrpc]
|
||||
enabled = true
|
||||
filter = wordpress-xmlrpc
|
||||
logpath = /var/log/nginx/*access.log
|
||||
maxretry = 1
|
||||
bantime = 1 day
|
||||
datepattern = %%d/%%b/%%Y:%%H:%%M:%%S \+%%f
|
||||
@ -0,0 +1,48 @@
|
||||
#
|
||||
# task: configure fail2ban
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
- name: adding configuration fail2ban/fail2ban.local
|
||||
template:
|
||||
src: fail2ban/fail2ban.local
|
||||
dest: /etc/fail2ban/fail2ban.local
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: adding configuration fail2ban/jail.local
|
||||
template:
|
||||
src: fail2ban/jail.local
|
||||
dest: /etc/fail2ban/jail.local
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: copy filters
|
||||
copy:
|
||||
src: ../resources/fail2ban/filters/
|
||||
dest: /etc/fail2ban/filter.d/
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: find & delete old jails files
|
||||
find:
|
||||
paths: /etc/fail2ban/jail.d
|
||||
register: fail2ban_outdated_files
|
||||
|
||||
- file:
|
||||
state: absent
|
||||
path: "{{ item.path }}"
|
||||
loop: "{{ fail2ban_outdated_files.files }}"
|
||||
when: fail2ban_outdated_files.files is defined
|
||||
|
||||
- name: enable jails
|
||||
copy:
|
||||
src: ../ressources/fail2ban/jail/{{ item }}
|
||||
dest: /etc/fail2ban/jail.d/{{ item }}
|
||||
with_items: "{{ common_fail2ban_jails }}"
|
||||
|
||||
- notify: restart fail2ban
|
||||
@ -0,0 +1,18 @@
|
||||
#
|
||||
# fail2ban
|
||||
# adding ssh jail
|
||||
#
|
||||
|
||||
#
|
||||
# ufw
|
||||
# only allows ssh
|
||||
#
|
||||
|
||||
- name: Configure ufw
|
||||
ufw:
|
||||
rule: allow
|
||||
name: OpenSSH
|
||||
|
||||
- name: Enable ufw
|
||||
ufw:
|
||||
state: enabled
|
||||
@ -0,0 +1,42 @@
|
||||
#
|
||||
# task: create deployer
|
||||
#
|
||||
#
|
||||
# @author Björn Hase <herrhase@node001.net>
|
||||
#
|
||||
|
||||
|
||||
- name: Check if users exist
|
||||
getent:
|
||||
database: passwd
|
||||
key: deploy
|
||||
fail_key: false
|
||||
|
||||
- name: create password
|
||||
set_fact:
|
||||
password="{{ lookup('ansible.builtin.password', '~/deploy.txt', length=30, chars=['ascii_letters', 'digits']) }}"
|
||||
|
||||
#
|
||||
# create user if not exists
|
||||
#
|
||||
- name: create user
|
||||
user:
|
||||
name: deploy
|
||||
password: "{{ password }}"
|
||||
create_home: yes
|
||||
when: ansible_facts.getent_passwd|bool == false
|
||||
|
||||
#
|
||||
# create ssh-key add to authorized_keys as deploy user
|
||||
#
|
||||
- stat:
|
||||
path: ~/.ssh/git
|
||||
become_user: deploy
|
||||
register: git_key
|
||||
|
||||
- name: create ssh
|
||||
shell: |
|
||||
ssh-keygen -t ed25519 -f ~/.ssh/git -C $(hostname) -q -P ""
|
||||
cat ~/.ssh/git.pub >> ~/.ssh/authorized_keys
|
||||
become_user: deploy
|
||||
when: ansible_facts.getent_passwd|bool == false and not git_key.stat.exists
|
||||
@ -0,0 +1,30 @@
|
||||
#
|
||||
# task: install
|
||||
#
|
||||
|
||||
- name: Remove ubuntu tools
|
||||
apt:
|
||||
name: ubuntu-advantage-tools
|
||||
state: absent
|
||||
|
||||
#
|
||||
# install software packages
|
||||
#
|
||||
|
||||
- name: Install unzip, curl, software-properties-common, git & ca-certificates gnupg
|
||||
apt:
|
||||
name:
|
||||
- unzip
|
||||
- curl
|
||||
- software-properties-common
|
||||
- ca-certificates
|
||||
- gnupg
|
||||
- git
|
||||
- ufw
|
||||
- fail2ban
|
||||
- sshpass
|
||||
- python3
|
||||
- python3-pip
|
||||
- python3-passlib
|
||||
update_cache: yes
|
||||
cache_valid_time: 3600
|
||||
@ -0,0 +1,29 @@
|
||||
#
|
||||
# task: update
|
||||
#
|
||||
|
||||
- name: Updates with APT
|
||||
apt:
|
||||
name: '*'
|
||||
state: latest
|
||||
update_cache: yes
|
||||
only_upgrade: yes
|
||||
|
||||
#
|
||||
# check for reboot
|
||||
#
|
||||
|
||||
- name: Check if a reboot is needed for Debian and Ubuntu boxes
|
||||
register: reboot_required_file
|
||||
stat:
|
||||
path: /var/run/reboot-required
|
||||
|
||||
- name: Reboot the Debian or Ubuntu server
|
||||
reboot:
|
||||
msg: "Reboot initiated by Ansible due to kernel updates"
|
||||
connect_timeout: 5
|
||||
reboot_timeout: 300
|
||||
pre_reboot_delay: 0
|
||||
post_reboot_delay: 30
|
||||
test_command: uptime
|
||||
when: reboot_required_file.stat.exists
|
||||
@ -0,0 +1,17 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
# Overrides values from the fail2ban.conf configuration file.
|
||||
# For comments relating to each setting see fail2ban.conf
|
||||
|
||||
[default]
|
||||
|
||||
loglevel = {{ common_fail2ban_loglevel }}
|
||||
logtarget = {{ common_fail2ban_logtarget }}
|
||||
syslogsocket = {{ common_fail2ban_syslog_socket }}
|
||||
|
||||
socket = /var/run/fail2ban/fail2ban.sock
|
||||
pidfile = /var/run/fail2ban/fail2ban.pid
|
||||
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
|
||||
|
||||
dbpurgeage = {{ common_fail2ban_dbpurgeage }}
|
||||
dbmaxmatches = {{ common_fail2ban_dbmaxmatches }}
|
||||
@ -0,0 +1,56 @@
|
||||
{{ ansible_managed | comment }}
|
||||
|
||||
[includes]
|
||||
|
||||
before = paths-debian.conf
|
||||
|
||||
[default]
|
||||
|
||||
# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
|
||||
# ban a host which matches an address in this list. Several addresses can be
|
||||
# defined using space separator.
|
||||
ignoreip = {{ common_fail2ban_ignoreips | join(' ') }}
|
||||
ignoreself = {{ common_fail2ban_ignoreself }}
|
||||
|
||||
# The length of time between login attempts before a ban is set.
|
||||
# For example, if Fail2ban is set to ban an IP after five (3) failed log-in attempts,
|
||||
# those 3 attempts must occur within the set 10-minute findtime limit.
|
||||
# The findtime value should be a set number of seconds.
|
||||
findtime = {{ common_fail2ban_findtime }}
|
||||
|
||||
# max retries, before ban
|
||||
maxretry = {{ common_fail2ban_maxretry }}
|
||||
|
||||
# reverse-Lookup-behavior
|
||||
usedns = warn
|
||||
|
||||
# mail
|
||||
destemail = root@localhost
|
||||
sendername = Fail2Ban
|
||||
mta = sendmail
|
||||
|
||||
#
|
||||
chain = INPUT
|
||||
|
||||
#
|
||||
# Actions
|
||||
#
|
||||
|
||||
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s", sendername="%(sendername)s"]
|
||||
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
||||
%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s", sendername="%(sendername)s"]
|
||||
action = %(action_)s
|
||||
|
||||
# "bantime" is the number of seconds that a host is banned.
|
||||
bantime = {{ common_fail2ban_bantime }}
|
||||
|
||||
# "banaction"
|
||||
banaction = ufw
|
||||
|
||||
# backend
|
||||
backend = auto
|
||||
|
||||
# tcp, udp, icmp, all
|
||||
protocol = {{ common_fail2ban_protocol }}
|
||||
Loading…
Reference in new issue