Ansible Role: Install Fail2Ban

Installs Fail2Ban from source on Debian/Ubuntu linux servers.

Requirements

None

Role Variables

Available variables are listed below, along with default values (see defaults/main.yml):

fail2ban_download_url: 'https://github.com/fail2ban/fail2ban/archive/0.9.3.tar.gz'
fail2ban_workspace: '/opt'

fail2ban_jail_dir: '/etc/fail2ban/jail.d'

fail2ban_apt_packages:
  - whois
  - iptables-persistent

Dependencies

None.

Installation

$ ansible-galaxy install tschifftner.fail2ban

Example Playbook

- hosts: server

  vars:
    # Ignore all own ips
    fail2ban_ignoreip: "{{ ansible_all_ipv4_addresses }}"
      
    fail2ban_jails:
      - name: 'ssh'
        enabled: true
        port: ssh
        filter: sshd
        logpath: /var/log/auth.log
        maxretry: 3
    
      - name: 'ssh-ddos'
        enabled: true
        port: ssh
        bantime: 86400
        filter: 'sshd-ddos'
        logpath: /var/log/auth.log
        maxretry: 6

  roles:
    - { role: tschifftner.fail2ban }

Supported OS

• Debian 9 (Stretch)
• Debian 8 (Jessie)
• Ubuntu 18.04 (Bionic Beaver)
• Ubuntu 16.04 (Xenial Xerus)

Required ansible version

Ansible 2.5+

License

MIT License

Author Information

• Tobias Schifftner, ambimax® GmbH