mirror of
https://gitlab.archlinux.org/archlinux/infrastructure.git
synced 2026-09-11 16:30:32 +02:00
Levente PolyakandChristian Heusel
963c7cf31e
Firewalld ipset rules are only checked after the fast-track for ESTABLISHED,RELATED connection states. This means abusers with an already open connection can re-use them to keep sending malicious requests to the backend even if the ip is added to the drop ipset. To fix this loophole, cut the connection forcefully using conntrack, which will force the abuser to go through connection setup, where the drop ipset will be evaluate.
132 lines
2.9 KiB
YAML
132 lines
2.9 KiB
YAML
- name: Install fail2ban
|
|
package:
|
|
name: "fail2ban"
|
|
state: "present"
|
|
notify:
|
|
- Restart fail2ban
|
|
|
|
- name: Install conntrack-tools
|
|
package:
|
|
name: "conntrack-tools"
|
|
state: "present"
|
|
|
|
- name: Create systemd unit override path
|
|
file:
|
|
path: "/etc/systemd/system/fail2ban.service.d"
|
|
state: "directory"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0755'
|
|
|
|
- name: Install systemd unit override file
|
|
template:
|
|
src: "fail2ban.service.j2"
|
|
dest: "/etc/systemd/system/fail2ban.service.d/override.conf"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
|
|
- name: Install local config files
|
|
template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/fail2ban/{{ item }}"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
loop:
|
|
- "fail2ban.local"
|
|
- "jail.local"
|
|
notify:
|
|
- Restart fail2ban
|
|
|
|
- name: Install firewallcmd-ipset-allports.conf
|
|
template:
|
|
src: "firewallcmd-ipset-allports.conf.j2"
|
|
dest: "/etc/fail2ban/action.d/firewallcmd-ipset-allports.conf"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
notify:
|
|
- Restart fail2ban
|
|
|
|
- name: Install sshd jail
|
|
when: fail2ban_jails.sshd
|
|
template:
|
|
src: "sshd.jail.j2"
|
|
dest: "/etc/fail2ban/jail.d/sshd.local"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
notify:
|
|
- Reload fail2ban jails
|
|
|
|
- name: Install postfix jail
|
|
when: fail2ban_jails.postfix
|
|
template:
|
|
src: "postfix.jail.j2"
|
|
dest: "/etc/fail2ban/jail.d/postfix.local"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
notify:
|
|
- Reload fail2ban jails
|
|
|
|
- name: Install dovecot jail
|
|
when: fail2ban_jails.dovecot
|
|
template:
|
|
src: "dovecot.jail.j2"
|
|
dest: "/etc/fail2ban/jail.d/dovecot.local"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
notify:
|
|
- Reload fail2ban jails
|
|
|
|
- name: Install nginx-limit-req jail
|
|
when: fail2ban_jails.nginx_limit_req
|
|
template:
|
|
src: "nginx-limit-req.jail.j2"
|
|
dest: "/etc/fail2ban/jail.d/nginx-limit-req.local"
|
|
owner: "root"
|
|
group: "root"
|
|
mode: '0644'
|
|
notify:
|
|
- Reload fail2ban jails
|
|
|
|
- name: Install fail2ban ipset for firewalld
|
|
copy: src="{{ item }}" dest=/etc/firewalld/ipsets/ owner=root group=root mode=0644
|
|
register: result
|
|
loop:
|
|
- fail2ban.xml
|
|
- fail2ban6.xml
|
|
|
|
- name: Restart firewalld
|
|
systemd_service: name=firewalld state=stopped
|
|
when: result.changed
|
|
|
|
- name: Restart firewalld
|
|
systemd_service: name=firewalld state=started
|
|
when: result.changed
|
|
|
|
- name: Add fail2ban ipset to the firewalld drop zone
|
|
ansible.posix.firewalld: source="ipset:{{ item }}" zone=drop permanent=true state=enabled
|
|
register: result
|
|
loop:
|
|
- fail2ban
|
|
- fail2ban6
|
|
|
|
- name: Restart firewalld
|
|
systemd_service: name=firewalld state=stopped
|
|
when: result.changed
|
|
|
|
- name: Restart firewalld
|
|
systemd_service: name=firewalld state=started
|
|
when: result.changed
|
|
|
|
- name: Start and enable service
|
|
systemd_service:
|
|
name: "fail2ban.service"
|
|
enabled: true
|
|
state: started
|
|
daemon-reload: true
|