Set up fail2ban in Debian-like systems.
None
-
fail2ban_loglevel: [default:INFO]: Sets the loglevel output (CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG) -
fail2ban_logtarget: [default:/var/log/fail2ban.log]: Sets the log target. This could be a file, SYSLOG, STDERR or STDOUT -
fail2ban_syslog_target: [default:/var/log/fail2ban.log]: -
fail2ban_syslog_facility: [default:1]: -
fail2ban_socket: [default:/var/run/fail2ban/fail2ban.sock]: Sets the socket file, which is used to communicate with the daemon -
fail2ban_pidfile: [default:/var/run/fail2ban/fail2ban.pid]: Sets the pid file, which is used to to store the process ID of the daemon (Only works onfail2ban >= 0.8.9) -
fail2ban_ignoreips: [default:[127.0.0.1/8]]: Which IP address/CIDR mask/DNS host should be ignored from fail2ban's actions -
fail2ban_bantime: [default:600]: Sets the bantime -
fail2ban_maxretry: [default:3]: Maximum number of retries before the host is put into jail -
fail2ban_findtime: [default:600]: A host is banned if it has generatedfail2ban_maxretryduring the lastfail2ban_findtime(this can be overriden for each service) -
fail2ban_backend: [default:auto]: Specifies the backend used to get files modification -
fail2ban_banaction: [default:iptables-multiport]: Sets the global/default banaction (can be overriden on a per role basis) -
fail2ban_mta: [default:sendmail]: Email action -
fail2ban_protocol: [default:tcp]: Sets the default protocol -
fail2ban_chain: [default:INPUT]: Specifies the chain where jumps would need to be added in iptables-* actions -
fail2ban_action: [default:action_]: Default action -
fail2ban_sendername: [default:Fail2ban]: The 'from' name for emails sent by mta actions. NB: Usefail2ban_senderto set the 'from' email address. -
fail2ban_sender: [optional]: The 'from' address for emails sent by mta actions. -
fail2ban_filterd_path: [optional]: Path to directory containing filters to copy (note the trailing slash) -
fail2ban_actiond_path: [optional]: Path to directory containing actions to copy (note the trailing slash) -
fail2ban_jaild_path: [optional]: Path to directory containing jails to copy (note the trailing slash)
For each of the services you wish to protect/put a jail or ban up for, you need to add it to the fail2ban_services list of hashes:
fail2ban_services:
- name: ssh
enabled: true
port: ssh
filter: sshd
logpath: /var/log/auth.log
maxretry: 6
protocol: tcp (optional)
action: action_ (optional)
banaction: iptables-multiport (optional)
bantime: 600 (optional)
findtime: 600 (optional)None
---
- hosts: all
roles:
- fail2ban---
- hosts: all
roles:
- fail2ban
vars:
fail2ban_filterd_path: ../../../files/fail2ban/etc/fail2ban/filter.d/
fail2ban_services:
- name: apache-wordpress-logins
enabled: true
port: http,https
filter: apache-wordpress-logins
logpath: /var/log/apache2/access.log
maxretry: 5
findtime: 120MIT
Mischa ter Smitten (based on work of ANXS)
Are welcome!