Initial ansible onboard

ansible/roles/fail2ban/.ansible-lint

@@ -0,0 +1,10 @@
+---
+exclude_paths:
+  - .git/
+  - .github/
+  - tests/
+enable_list:
+  - fqcn-builtins  # opt-in
+warn_list:
+  - line-length
+  - yaml[line-length]

ansible/roles/fail2ban/.yamllint

@@ -0,0 +1,15 @@
+---
+extends: default
+ignore: ".tox*\n.git*"
+rules:
+  line-length:
+    max: 120
+    level: warning
+  comments:
+    min-spaces-from-content: 1
+  comments-indentation: false
+  braces:
+    max-spaces-inside: 1
+  octal-values:
+    forbid-implicit-octal: true
+    forbid-explicit-octal: true

ansible/roles/fail2ban/defaults/main.yml

@@ -0,0 +1,49 @@
+---
+
+# Defaults vars file for fail2ban role
+
+# Repositories variables
+# -----------------------------------------------------------------------------
+fail2ban_repository_update_cache: true
+fail2ban_repository_cache_valid_time: 3600
+
+
+# Package variables
+# -----------------------------------------------------------------------------
+fail2ban_package_state: 'present'
+fail2ban_packages: "{{ _fail2ban_packages }}"
+
+
+# Service variables
+# -----------------------------------------------------------------------------
+fail2ban_service_enabled: true
+fail2ban_service_name: "{{ _fail2ban_service_name }}"
+fail2ban_service_state: 'started'
+
+
+# Paths
+# -----------------------------------------------------------------------------
+_fail2ban_paths:
+  files:
+    action: {}
+    filter: {}
+    main_config:
+      path: '/etc/fail2ban/fail2ban.conf'
+    jail_local:
+      path: '/etc/fail2ban/jail.local'
+  folders:
+    action:
+      path: '/etc/fail2ban/action.d'
+    filter:
+      path: '/etc/fail2ban/filter.d'
+    main:
+      path: '/etc/fail2ban'
+fail2ban_paths: "{{ _fail2ban_paths }}"
+
+
+# Configuration
+# -----------------------------------------------------------------------------
+fail2ban_actions: {}
+fail2ban_filters: {}
+fail2ban_jails: "{{ _fail2ban_jails }}"
+fail2ban_main_config_content: "{{ _fail2ban_main_config_content }}"

ansible/roles/fail2ban/handlers/main.yml

@@ -0,0 +1,14 @@
+---
+# Handlers main file for fail2ban role
+
+- name: "HANDLER | Restart fail2ban"
+  become: true
+  ansible.builtin.service:
+    name: "{{ fail2ban_service_name }}"
+    state: "restarted"
+  when: fail2ban_service_state != 'stopped' and molecule_yml is not defined
+  tags:
+    - "role::fail2ban"
+    - "role::fail2ban::config"
+    - "role::fail2ban::install"
+    - "role::fail2ban::service"

ansible/roles/fail2ban/molecule/default/INSTALL.rst

@@ -0,0 +1,23 @@
+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

ansible/roles/fail2ban/molecule/default/converge.yml

@@ -0,0 +1,7 @@
+---
+- name: Converge
+  hosts: all
+  tasks:
+    - name: "Include fail2ban"
+      ansible.builtin.include_role:
+        name: "fail2ban"

ansible/roles/fail2ban/molecule/default/molecule.yml

@@ -0,0 +1,44 @@
+---
+dependency:
+  name: galaxy
+  enabled: true
+driver:
+  name: podman
+platforms:
+  - name: instance
+    image: ubuntu:20.04
+    pre_build_image: true
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:ro
+    privileged: true
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      callbacks_enabled: profile_tasks
+  log: true
+  inventory:
+    group_vars:
+      all:
+        fail2ban_actions:
+          test_role:
+            Definition:
+              actionstart: "foo"
+              actionstop: "bar"
+            Init:
+              foo: "bar"
+        fail2ban_filters:
+          test_role_2:
+            INCLUDES:
+              before: "common.conf"
+            Definition:
+              failregex: "^foo.*$$"
+              ignoreregex: "^bar.*$$"
+    host_vars: {}
+  playbooks:
+    converge: converge.yml
+    prepare: prepare.yml
+verifier:
+  name: ansible
+scenario:
+  name: default

ansible/roles/fail2ban/molecule/default/prepare.yml

@@ -0,0 +1,10 @@
+---
+- name: Prepare
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Update cache # noqa no-changed-when
+      ansible.builtin.raw: apt update
+
+    - name: Install required packages # noqa no-changed-when
+      ansible.builtin.raw: apt install -y python3 sudo

ansible/roles/fail2ban/molecule/default/verify.yml

@@ -0,0 +1,9 @@
+---
+# This is an example playbook to execute Ansible tests.
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: Example assertion
+      ansible.builtin.assert:
+        that: true

ansible/roles/fail2ban/requirements.yml

@@ -0,0 +1,3 @@
+---
+collections:
+  - community.general

ansible/roles/fail2ban/tasks/install_debian.yml

@@ -0,0 +1,12 @@
+---
+
+- name: 'INSTALL | APT | Install fail2ban packages'
+  ansible.builtin.apt:
+    name: "{{ item.name }}"
+    state: "{{ item.state | default('present') }}"
+    update_cache: "{{ fail2ban_repository_update_cache }}"
+    cache_valid_time: "{{ fail2ban_repository_cache_valid_time }}"
+  become: true
+  with_items: "{{ fail2ban_packages }}"
+  notify:
+    - 'HANDLER | Restart fail2ban'

ansible/roles/fail2ban/tasks/install_redhat.yml

@@ -0,0 +1,9 @@
+---
+- name: "INSTALL | YUM | Install fail2ban packages"
+  ansible.builtin.dnf:
+    name: "{{ item.name }}"
+    state: "{{ item.state | default('present') }}"
+  with_items: "{{ fail2ban_packages }}"
+  become: true
+  notify:
+    - "HANDLER | Restart fail2ban"

ansible/roles/fail2ban/tasks/main.yml

@@ -0,0 +1,32 @@
+---
+
+# Main tasks file for fail2ban role
+
+- name: 'INIT | Manage variables to use for our target'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_variables.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::config'
+    - 'role::fail2ban::install'
+
+
+- name: 'INSTALL | Manage install on family OS'
+  ansible.builtin.include_tasks: "{{ role_path }}/tasks/install_{{ ansible_os_family | lower }}.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::install'
+
+
+- name: 'CONFIG | Include configuration tasks'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_config.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::config'
+
+
+- name: 'SERVICE | Include services tasks'
+  ansible.builtin.import_tasks: "{{ role_path }}/tasks/manage_service.yml"
+  tags:
+    - 'role::fail2ban'
+    - 'role::fail2ban::install'
+    - 'role::fail2ban::service'

ansible/roles/fail2ban/tasks/manage_config.yml

@@ -0,0 +1,79 @@
+---
+
+# Configuration tasks file for fail2ban
+# =============================================================================
+
+- name: 'CONFIG | PATHS | Ensure main configuration folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.main.path }}"
+    owner: "{{ fail2ban_paths.folders.main.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.main.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.main.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Ensure actions folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.action.path }}"
+    owner: "{{ fail2ban_paths.folders.action.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.action.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.action.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Ensure filters folder exists'
+  ansible.builtin.file:
+    dest: "{{ fail2ban_paths.folders.filter.path }}"
+    owner: "{{ fail2ban_paths.folders.filter.owner | default('root') }}"
+    group: "{{ fail2ban_paths.folders.filter.group | default('root') }}"
+    mode: "{{ fail2ban_paths.folders.filter.mode | default('0755') }}"
+    state: 'directory'
+
+
+- name: 'CONFIG | Manage main configuration file'
+  community.general.ini_file:
+    dest: "{{ fail2ban_paths.files.main_config.path }}"
+    owner: "{{ fail2ban_paths.files.main_config.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.main_config.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.main_config.mode | default('0644') }}"
+    section: "{{ item.section | default('Definition') }}"
+    option: "{{ item.option }}"
+    value: "{{ item.value }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_items: "{{ fail2ban_main_config_content }}"
+  become: true
+
+
+- name: 'CONFIG | Manage actions configurations files'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/action.conf.j2"
+    dest: "{{ fail2ban_paths.folders.action.path }}/{{ item.key }}.conf"
+    owner: "{{ fail2ban_paths.files.action.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.action.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.action.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_dict: "{{ fail2ban_actions }}"
+  become: true
+
+
+- name: 'CONFIG | Manage filters configurations files'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/filter.conf.j2"
+    dest: "{{ fail2ban_paths.folders.filter.path }}/{{ item.key }}.conf"
+    owner: "{{ fail2ban_paths.files.filter.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.filter.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.filter.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  with_dict: "{{ fail2ban_filters }}"
+  become: true
+
+
+- name: 'CONFIG | Manage local jails configuration file'
+  ansible.builtin.template:
+    src: "{{ role_path }}/templates/jail.local.j2"
+    dest: "{{ fail2ban_paths.files.jail_local.path }}"
+    owner: "{{ fail2ban_paths.files.jail_local.owner | default('root') }}"
+    group: "{{ fail2ban_paths.files.jail_local.group | default('root') }}"
+    mode: "{{ fail2ban_paths.files.jail_local.mode | default('0644') }}"
+  notify: 'HANDLER | Restart fail2ban'
+  become: true

ansible/roles/fail2ban/tasks/manage_service.yml

@@ -0,0 +1,11 @@
+---
+# Service tasks file for fail2ban
+# =============================================================================
+
+- name: "SERVICE | Manage service state"
+  ansible.builtin.service:
+    name: "{{ fail2ban_service_name }}"
+    state: "{{ fail2ban_service_state }}"
+    enabled: "{{ fail2ban_service_enabled }}"
+  become: true
+  when: molecule_yml is not defined

ansible/roles/fail2ban/tasks/manage_variables.yml

@@ -0,0 +1,41 @@
+---
+
+# All tasks about variables management
+
+- name: 'INIT | VARIABLES | Check if OS family vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_family/{{ ansible_os_family | lower }}.yml"
+  register: 'fail2ban_check_os_family_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Check if OS distribution vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}.yml"
+  register: 'fail2ban_check_os_distribution_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Check if OS release vars file exists'
+  become: false
+  ansible.builtin.stat:
+    path: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}/{{ ansible_distribution_release | lower }}.yml"
+  register: 'fail2ban_check_os_release_vars'
+  delegate_to: '127.0.0.1'
+
+
+- name: 'INIT | VARIABLES | Load OS family vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_family/{{ ansible_os_family | lower }}.yml"
+  when: "fail2ban_check_os_family_vars.stat.exists"
+
+
+- name: 'INIT | VARIABLES | Load OS distribution vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}.yml"
+  when: "fail2ban_check_os_distribution_vars.stat.exists"
+
+
+- name: 'INIT | VARIABLES | Load OS release vars file'
+  ansible.builtin.include_vars: "{{ role_path }}/vars/os_distribution/{{ ansible_distribution | lower }}/{{ ansible_distribution_release | lower }}.yml"
+  when: "fail2ban_check_os_release_vars.stat.exists"

ansible/roles/fail2ban/templates/action.conf.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+
+# Action configuration for {{ item.key }}
+
+{% for section_name, section_items in item.value.items() %}
+[{{ section_name }}]
+{% for key, value in section_items.items() %}
+{{ key }} = {{ value }}
+{% endfor %}
+
+{% endfor %}

ansible/roles/fail2ban/templates/fail2ban.conf.j2

@@ -0,0 +1,41 @@
+# {{ ansible_managed }}
+
+# Fail2Ban configuration file
+
+[Definition]
+
+# Option:  loglevel
+# Notes.:  Set the log level output.
+#          1 = ERROR
+#          2 = WARN
+#          3 = INFO
+#          4 = DEBUG
+# Values:  NUM  Default:  3
+#
+loglevel = {{ fail2ban_loglevel }}
+
+# Option:  logtarget
+# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#          Only one log target can be specified.
+# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
+#
+logtarget = {{ fail2ban_logtarget }}
+{% if fail2ban_logtarget == 'SYSLOG' %}
+syslog-target   = {{ fail2ban_syslog_target }}
+syslog-facility = {{ fail2ban_syslog_facility }}
+{% endif %}
+
+# Option: socket
+# Notes.: Set the socket file. This is used to communicate with the daemon. Do
+#         not remove this file when Fail2ban runs. It will not be possible to
+#         communicate with the server afterwards.
+# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
+#
+socket = {{ fail2ban_socket }}
+
+# Option: pidfile
+# Notes.: Set the PID file. This is used to store the process ID of the
+#         fail2ban server.
+# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.pid
+#
+pidfile = {{ fail2ban_pidfile }}

ansible/roles/fail2ban/templates/filter.conf.j2

@@ -0,0 +1,11 @@
+# {{ ansible_managed }}
+
+# Filter configuration for {{ item.key }}
+
+{% for section_name, section_items in item.value.items() %}
+[{{ section_name }}]
+{% for key, value in section_items.items() %}
+{{ key }} = {{ value }}
+{% endfor %}
+
+{% endfor %}

ansible/roles/fail2ban/templates/jail.local.j2

@@ -0,0 +1,9 @@
+# {{ ansible_managed }}
+
+{% for section_name, section_items in fail2ban_jails.items() %}
+[{{ section_name }}]
+{% for key, value in section_items.items() %}
+{{ key }} = {{ value }}
+{% endfor %}
+
+{% endfor %}

ansible/roles/fail2ban/vars/main.yml

@@ -0,0 +1,3 @@
+---
+
+# Main vars file for fail2ban role

ansible/roles/fail2ban/vars/os_distribution/debian/jessie.yml

@@ -0,0 +1,13 @@
+---
+
+# Debian Jessie specific configuration
+
+_fail2ban_main_config_content:
+  - option: 'loglevel'
+    value: 3
+  - option: 'logtarget'
+    value: '/var/log/fail2ban.log'
+  - option: 'socket'
+    value: '/var/run/fail2ban/fail2ban.sock'
+  - option: 'pidfile'
+    value: '/var/run/fail2ban/fail2ban.pid'

ansible/roles/fail2ban/vars/os_distribution/ubuntu/trusty.yml

@@ -0,0 +1,13 @@
+---
+
+# Ubuntu Trusty specific variables
+
+_fail2ban_main_config_content:
+  - option: 'loglevel'
+    value: 3
+  - option: 'logtarget'
+    value: '/var/log/fail2ban.log'
+  - option: 'socket'
+    value: '/var/run/fail2ban/fail2ban.sock'
+  - option: 'pidfile'
+    value: '/var/run/fail2ban/fail2ban.pid'

ansible/roles/fail2ban/vars/os_distribution/ubuntu/xenial.yml

@@ -0,0 +1,34 @@
+---
+
+# Specific Xenial vars
+# =============================================================================
+
+# Main configuration
+# -----------------------------------------------------------------------------
+_fail2ban_main_config_content:
+  - option: 'loglevel'
+    value: 'INFO'
+  - option: 'logtarget'
+    value: '/var/log/fail2ban.log'
+  - option: 'syslogsocket'
+    value: 'auto'
+  - option: 'socket'
+    value: '/var/run/fail2ban/fail2ban.sock'
+  - option: 'pidfile'
+    value: '/var/run/fail2ban/fail2ban.pid'
+  - option: 'dbfile'
+    value: '/var/lib/fail2ban/fail2ban.sqlite3'
+  - option: 'dbpurgeage'
+    value: 86400
+
+
+# Jails configuration
+# -----------------------------------------------------------------------------
+_fail2ban_jails:
+  sshd:
+    enabled: true
+    port: 'ssh'
+    filter: 'sshd'
+    logpath: '/var/log/auth.log'
+    maxretry: 3
+    findtime: 600

ansible/roles/fail2ban/vars/os_family/debian.yml

@@ -0,0 +1,43 @@
+---
+
+# Debian OS family specific vars
+# =============================================================================
+
+# Package variables
+# -----------------------------------------------------------------------------
+_fail2ban_packages:
+  - name: 'fail2ban'
+
+
+# Service variables
+# -----------------------------------------------------------------------------
+_fail2ban_service_name: 'fail2ban'
+
+
+# Main configuration
+# -----------------------------------------------------------------------------
+_fail2ban_main_config_content:
+  - option: 'loglevel'
+    value: 3
+  - option: 'logtarget'
+    value: '/var/log/fail2ban.log'
+  - option: 'syslog-target'
+    value: '/var/log/fail2ban.log'
+  - option: 'syslog-facility'
+    value: 1
+  - option: 'socket'
+    value: '/var/run/fail2ban/fail2ban.sock'
+  - option: 'pidfile'
+    value: '/var/run/fail2ban/fail2ban.pid'
+
+
+# Jails configuration
+# -----------------------------------------------------------------------------
+_fail2ban_jails:
+  ssh:
+    enabled: true
+    port: 'ssh'
+    filter: 'sshd'
+    logpath: '/var/log/auth.log'
+    maxretry: 3
+    findtime: 600

ansible/roles/fail2ban/vars/os_family/redhat.yml

@@ -0,0 +1,43 @@
+---
+
+# RedHat OS family specific vars
+# =============================================================================
+
+# Package variables
+# -----------------------------------------------------------------------------
+_fail2ban_packages:
+  - name: 'fail2ban'
+
+
+# Service variables
+# -----------------------------------------------------------------------------
+_fail2ban_service_name: 'fail2ban'
+
+
+# Main configuration
+# -----------------------------------------------------------------------------
+_fail2ban_main_config_content:
+  - option: 'loglevel'
+    value: 3
+  - option: 'logtarget'
+    value: '/var/log/fail2ban.log'
+  - option: 'syslog-target'
+    value: '/var/log/fail2ban.log'
+  - option: 'syslog-facility'
+    value: 1
+  - option: 'socket'
+    value: '/var/run/fail2ban/fail2ban.sock'
+  - option: 'pidfile'
+    value: '/var/run/fail2ban/fail2ban.pid'
+
+
+# Jails configuration
+# -----------------------------------------------------------------------------
+_fail2ban_jails:
+  ssh:
+    enabled: true
+    port: 'ssh'
+    filter: 'sshd'
+    logpath: '/var/log/auth.log'
+    maxretry: 3
+    findtime: 600