31 lines
693 B
YAML
31 lines
693 B
YAML
---
|
|
# Configure fail2ban for SSH brute-force protection
|
|
|
|
- name: Ensure fail2ban is installed
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
|
|
- name: Configure fail2ban jail
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = {{ fail2ban_findtime }}
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = {{ ssh_port | default(22) }}
|
|
filter = sshd
|
|
logpath = /var/log/auth.log
|
|
mode: "0644"
|
|
notify: Restart fail2ban
|
|
|
|
- name: Ensure fail2ban is running
|
|
ansible.builtin.service:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: true
|