chore: update

defaults/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+
+fail2ban_setup: full
+fail2ban_defaults: { bantime: 7200, findtime: 600, maxretry: 3 }
+fail2ban_ignores_ips: []
+fail2ban_services: []
+fail2ban_alerts: { email: '', enabled: false, from: '' }
+
+fail2ban_blocktype: DROP
+fail2ban_default_ipset_lists: [whitelist, whitelist6]
+fail2ban_custom_ipset_lists: []
+fail2ban_enable_ignorecommand: false
+fail2ban_dummy_logs: false
+fail2ban_dummy_log_path: /var/log/fail2ban-dummy.log
+fail2ban_recidive_ignore_jails: []

tasks/tasks/configure.yml

@@ -0,0 +1,88 @@
+---
+
+- name: prepare systemd override
+  block:
+    - name: create fail2ban.service.d directory
+      file:
+        path: /etc/systemd/system/fail2ban.service.d
+        state: directory
+        mode: '0755'
+
+    - name: create fail2ban.service override
+      template:
+        src: systemd-override.j2
+        dest: /etc/systemd/system/fail2ban.service.d/override.conf
+      notify:
+        - reload fail2ban unit
+        - fail2ban restart
+  when: fail2ban_dummy_logs
+
+- name: create jail.local
+  template:
+    src: jail.j2
+    dest: /etc/fail2ban/jail.local
+    mode: 0644
+  notify: fail2ban restart
+
+- name: create iptables-multiport-fw.conf
+  template:
+    src: action_iptables-multiport-fw.j2
+    dest: /etc/fail2ban/action.d/iptables-multiport-fw.conf
+    mode: 0644
+  notify: fail2ban restart
+
+- name: create ipset ban ip action
+  template:
+    src: action_banip.j2
+    dest: /etc/fail2ban/action.d/ipset-banip.conf
+    mode: 0644
+  notify: fail2ban restart
+
+- name: deploy custom filters
+  template:
+    src: custom-filter.j2
+    dest: "/etc/fail2ban/filter.d/{{ item.name }}.conf"
+  with_items: "{{ fail2ban_filters }}"
+  when: fail2ban_filters is defined
+  notify: fail2ban restart
+
+- name: adjust blocktype in iptables conf
+  replace:
+    path: "{{ '/etc/fail2ban/action.d/iptables-ipset.conf' if ansible_distribution_release == 'noble' else '/etc/fail2ban/action.d/iptables-common.conf' }}"
+    regexp: '^blocktype =.+'
+    replace: "blocktype = {{ fail2ban_blocktype }}"
+  notify: fail2ban restart
+  when: not ansible_check_mode
+
+- name: create scripts directory
+  file:
+    dest: /usr/local/etc/scripts
+    state: directory
+  when: fail2ban_enable_ignorecommand
+
+- name: create custom.fail2ban-check-ip.conf
+  template:
+    src: check-ip_conf.j2
+    dest: /usr/local/etc/scripts/custom.fail2ban-check-ip.conf
+    mode: 0644
+  when: fail2ban_enable_ignorecommand and not ansible_check_mode
+
+- name: create custom.fail2ban-check-ip
+  template:
+    src: fail2ban-check-ip.j2
+    dest: /usr/local/sbin/custom.fail2ban-check-ip
+    mode: 0744
+  when: fail2ban_enable_ignorecommand
+
+- name: adjust ignoreregex in recidive filter
+  lineinfile:
+    path: /etc/fail2ban/filter.d/recidive.conf
+    regexp: '^ignoreregex'
+    line: "ignoreregex = .*\\[({{ fail2ban_recidive_ignore_jails | join('|') }})\\].*"
+  when: not ansible_check_mode and fail2ban_recidive_ignore_jails | length > 0
+
+- name: ensure fail2ban service is enabled and started
+  service:
+    name: fail2ban
+    enabled: true
+    state: started

tasks/tasks/install.yml

@@ -0,0 +1,9 @@
+---
+- name: install fail2ban
+  apt:
+    name: fail2ban
+    update_cache: true
+
+- name: gather installed packages
+  package_facts:
+    manager: apt

tasks/tasks/main.yml

@@ -0,0 +1,8 @@
+---
+
+- include_tasks: prepare.yml
+
+- include_tasks: install.yml
+  when: fail2ban_setup == "full"
+
+- include_tasks: configure.yml

tasks/tasks/prepare.yml

@@ -0,0 +1,45 @@
+---
+
+- name: create test dirs
+  file:
+    path: "{{ item }}"
+    state: directory
+  when: fail2ban_role_test_mode is defined
+  with_items:
+    - /var/log/nginx
+
+- name: create test log files
+  template:
+    src: testfile.j2
+    dest: "{{ item }}"
+  when: fail2ban_role_test_mode is defined
+  with_items:
+    - /var/log/nginx/test-error.log
+    - /tmp/web-prod.log
+    - /tmp/backend-prod.log
+
+- name: ensure syslog group is present
+  group:
+    name: syslog
+    system: true
+    state: present
+
+- name: ensure syslog user is present
+  user:
+    name: syslog
+    group: syslog
+    groups: adm
+    home: "{{ '/nonexistent' if ansible_distribution_release == 'noble' else '/home/syslog' }}"
+    create_home: no
+    shell: "{{ '/usr/sbin/nologin' if ansible_distribution_release == 'bionic' else '/bin/false' }}"
+    system: true
+    state: present
+
+- name: prepare auth.log
+  copy:
+    content: ""
+    dest: /var/log/auth.log
+    force: false
+    group: adm
+    owner: syslog
+    mode: 0640

templates/templates/action_banip.j2

@@ -0,0 +1,9 @@
+{% raw %}
+[Definition]
+actionban   = ipset add banlist <ip> -exist
+
+actionunban = ipset del banlist <ip> -exist
+
+[Init]
+bantime = 3600
+{% endraw %}

templates/templates/action_iptables-multiport-fw.j2

@@ -0,0 +1,23 @@
+{% raw %}[INCLUDES]
+
+before = iptables-blocktype.conf
+
+[Definition]
+
+actionstart = iptables -N fail2ban-<name>
+              iptables -A fail2ban-<name> -j RETURN
+              iptables -I <fwchain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+actionstop = iptables -D <fwchain> -p <protocol> -m multiport --dports <port> -j fail2ban-<name>
+             iptables -F fail2ban-<name>
+             iptables -X fail2ban-<name>
+actioncheck = iptables -n -L <fwchain> | grep -q 'fail2ban-<name>[ \t]'
+actionban = iptables -I fail2ban-<name> 1 -s <ip> -j <blocktype>
+actionunban = iptables -D fail2ban-<name> -s <ip> -j <blocktype>
+
+[Init]
+
+name = default
+port = ssh
+protocol = tcp
+fwchain = FORWARD
+{% endraw %}

templates/templates/check-ip_conf.j2

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+check_ip_lists=({% for list in fail2ban_default_ipset_lists %} {{ list }} {% endfor %}{% for list in fail2ban_custom_ipset_lists %} {{ list }} {% endfor %})

templates/templates/custom-filter.j2

@@ -0,0 +1,31 @@
+[Definition]
+
+{% for key, value in item.items() %}
+{% if key != 'name' and key == 'failregex' %}
+failregex = {% for item in value %}
+{% if item == value|first %}
+{{ item }}
+{% else %}
+{{ item|indent(12, True) }}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endfor %}
+
+{% for key, value in item.items() %}
+{% if key != 'name' and key == 'ignoreregex' %}
+ignoreregex = {% for item in value %}
+{% if item == value|first %}
+{{ item }}
+{% else %}
+{{ item|indent(14, True) }}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endfor %}
+
+{% for key, value in item.items() %}
+{% if key != 'name' and key != 'failregex' and key != 'ignoreregex' %}
+{{ key }} = {{ value }}
+{% endif %}
+{% endfor %}

templates/templates/fail2ban-check-ip.j2

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+target_ip=$1
+check_ip_config='/usr/local/etc/scripts/custom.fail2ban-check-ip.conf'
+
+test -s "${check_ip_config}" && . "${check_ip_config}"
+function check_ip_in_ipset() {
+  for list in "${check_ip_lists[@]}"; do
+    /sbin/ipset save "${list}" | grep -qE "${target_ip}" && return 0
+  done
+  return 1
+}
+
+check_ip_in_ipset

templates/templates/jail.j2

@@ -0,0 +1,61 @@
+[DEFAULT]
+{{ "%-13s = %s"|format('bantime', fail2ban_defaults.bantime | default('7200', true)) }}
+{{ "%-13s = %s"|format('findtime', fail2ban_defaults.findtime | default('600', true)) }}
+{{ "%-13s = %s"|format('maxretry', fail2ban_defaults.maxretry | default('3', true)) }}
+{% if fail2ban_alerts.enabled %}
+{{ "%-13s = %s"|format('sendername', fail2ban_alerts.from) }}
+{{ "%-13s = %s"|format('destemail', fail2ban_alerts.email) }}
+{{ "%-13s = %s"|format('action', '%(action_mwl)s') }}
+{% endif %}
+{{ "%-13s = %s %s"|format('ignoreip', '127.0.0.1/8', fail2ban_ignores_ips|join(' ')) }}
+{% if fail2ban_enable_ignorecommand %}
+{{ "%-13s = %s"|format('ignorecommand', '/usr/local/sbin/custom.fail2ban-check-ip <ip>') }}
+{% endif %}
+{% if 'openssh-server' in ansible_facts.packages %}
+
+[sshd]
+{{ "%-10s = %s"|format('enabled', fail2ban_sshd.enabled | default('true', true)) }}
+{{ "%-10s = %s"|format('ports', fail2ban_sshd.ports | default('22', true)) }}
+{{ "%-10s = %s"|format('maxretry', fail2ban_sshd.maxretry | default(fail2ban_defaults.maxretry, true)) }}
+{{ "%-10s = %s"|format('bantime', fail2ban_sshd.bantime | default(fail2ban_defaults.bantime, true)) }}
+{{ "%-10s = %s"|format('findtime', fail2ban_sshd.findtime | default('1800', true)) }}
+action = ipset-banip
+{% endif %}
+{% if fail2ban_containers is defined and fail2ban_containers|length %}
+{% for container in fail2ban_containers %}
+
+[sshd-lxc-{{ container.name }}]
+{{ "%-10s = %s"|format('enabled', container.enabled | default('true', true)) }}
+{{ "%-10s = %s"|format('logpath', container.logpath | mandatory) }}
+{% if fail2ban_dummy_logs %}
+{{ fail2ban_dummy_log_path|indent(13, True) }}
+{% endif %}
+{{ "%-10s = %s"|format('filter', container.filter | default('sshd', true)) }}
+{{ "%-10s = %s"|format('port', container.port | default('22', true)) }}
+{{ "%-10s = %s"|format('backend', container.backend | default('polling', true)) }}
+{{ "%-10s = %s"|format('chain', container.chain | default('FORWARD', true)) }}
+{{ "%-10s = %s"|format('banaction', container.banaction | default('iptables-multiport', true)) }}
+{{ "%-10s = %s"|format('bantime', container.bantime | default('10000', true)) }}
+{{ "%-10s = %s"|format('maxretry', container.maxretry | default('3', true)) }}
+{{ "%-10s = %s"|format('findtime', container.findtime | default('1800', true)) }}
+{% endfor %}
+{% endif %}
+{% if fail2ban_services is defined and fail2ban_services|length %}
+{% for service in fail2ban_services %}
+
+[{{ service.name }}]
+{% if not service.enabled is defined %}
+{{ "%-10s = %s"|format("enabled", "True") }}
+{% endif %}
+{% for key, value in service.items()|sort() %}
+{% if key != 'name' %}
+{% if key == 'logpath' and fail2ban_dummy_logs %}
+{{ "%-10s = %s"|format(key, value) }}
+{{ fail2ban_dummy_log_path|indent(13, True) }}
+{% else %}
+{{ "%-10s = %s"|format(key, value) }}
+{% endif %}
+{% endif %}
+{% endfor %}
+{% endfor %}
+{% endif %}

templates/templates/systemd-override.j2

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPre=/usr/bin/touch {{ fail2ban_dummy_log_path }}

templates/templates/testfile.j2

@@ -0,0 +1 @@
+This file is needed for role testing.