fail2ban
ansible-role-fail2ban
This role install and configures Fail2ban.
Requirements
Ansible 2.10 or newer.
Supported Platforms
- Debian - 11 (Bullseye)
- Debian - 12 (Bookworm)
- Ubuntu - 22.04 (Jammy Jellyfish)
- Ubuntu - 24.04 (Noble Numbat)
Role Variables
Variable | Required | Default | Choices | Comments |
---|---|---|---|---|
fail2ban_dependencies | yes | [fail2ban] |
list | |
fail2ban_configuration | yes | {} |
dict | Local main configuration. |
fail2ban_jails | yes | {} |
dict | Local jail configuration. |
fail2ban_filters | yes | {} |
dict | Custom filters configuration. |
fail2ban_actions | yes | {} |
dict | Custom actions configuration. |
Dependencies
None
Example Playbook
- hosts: all
roles:
- role: ansible-role-fail2ban
fail2ban_configuration:
Definition:
loglevel: WARNING
fail2ban_jails:
DEFAULT:
ignoreip: 127.0.0.1/8
nginx-badbots:
enabled: 'true'
action: nginx-deny-host[name = nginx-http-auth, port = http, protocol = tcp]
port: http
filter: nginx-badbots
logpath: /var/log/nginx_error.log
maxretry: 5
findtime: 600
fail2ban_filters:
nginx-badbots:
Definition:
_daemon: nginx-badbots
failregex: |
^ \[error\] \d+#\d+: .* access forbidden by rule, client: <HOST>, .*$
FastCGI sent in stderr: "Primary script unknown" .*, client: <HOST>
ignoreregex: ''
fail2ban_actions:
nginx-deny-host:
Definition:
actionban: |
sed -i "/deny <ip>;/d" <file>
echo "deny <ip>;" >> <file>
systemctl reload nginx
actionunban: |
sed -i "/deny <ip>;/d" <file>
systemctl reload nginx
Init:
file: /etc/nginx/hosts.deny
Testing
molecule test
License
MIT
Author Information
Install
ansible-galaxy install boutetnico/ansible-role-fail2ban
License
mit
Downloads
15
Owner
System Engineer