Giter Club home page Giter Club logo

ansible-fail2ban's People

Contributors

jonhattan avatar nickhammond avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

dev-ace nickhammond briceburg r-daneel slaarti

ansible-fail2ban's Issues

avoid overrinding default dist-provided files

The role itself should follow the guidelines proposed by the fail2ban author: do not erase default files.
Default fail2ban.conff and jail.conf should be kept default.
This have the advantage than upgrades get smoothly and that this role don't need to be upgraded at each major distribution upgrade. Or, state differently one could upgrade its machines without being blocked waiting for an upgrade of sbitmedia.fail2ban
Eg: in Debian Jessie, fail2ban.conf and jail.conf changed.

This patch fixes this:

diff --git a/tasks/config.yml b/tasks/config.yml
index f5eb286..6cf6742 100644
--- a/tasks/config.yml
+++ b/tasks/config.yml
@@ -6,6 +6,7 @@
     - "fail2ban.conf.default"
   notify:
     - restart fail2ban
+  when: fail2ban_override_dist_default == true
   tags:
     - fail2ban
     - config
@@ -25,6 +26,7 @@
     - "jail.conf.default"
   notify:
     - restart fail2ban
+  when: fail2ban_override_dist_default == true
   tags:
     - fail2ban
     - config
diff --git a/vars/main.yml b/vars/main.yml
index 11b9ea3..676cf31 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -13,3 +13,4 @@ fail2ban_pidfile: /var/run/fail2ban/fail2ban.pid
 # Directory to store configuration parts to assemble jail.local.
 fail2ban_dir_parts: /var/tmp/ansible/fail2ban-parts

+fail2ban_override_dist_default: false

make the action,_plugin a real library

I've a bootstrap role setting a few jails for fail2ban, and thus setting in it's meta/mail.yml:

dependencies:
  - { role: sbitmedia.fail2ban, fail2ban_.... ... }

But then I've some machine, which depends upon my bootstrap role which need to set more jails.
Sadly, in the current situation, they can't make use of the action: fail2ban_jail because:

  1. in theory they should not be able to load again sbitmedia.fail2ban since it was already loaded during this run (without a allow_duplicates), see https://docs.ansible.com/playbooks_roles.html
  2. anyway I can have the bootstrap role to load sbitmedia.fail2ban, while adding:
  roles:
    - bootstrap   # has itself dependencies on sbitmedia.fail2ban
    - sbitmedia.fail2ban

... but in that case the second (and upper-level) call to sbitmedia.fail2ban will reinitialize my jail.local.
jail.local is just an ini_file, should we go that way?

Dies without a proper error message

This playbook:

- hosts: www
  roles:
    - sbitmedia.fail2ban
  tasks:
  - apt: name=fail2ban state=latest
  - fail2ban_jail:
      args:
        name: ssh-jail
        enabled: true
        filter: sshd
        port: ssh
        logpath: /var/log/auth.log
        maxretry: 6
        bantime: 600

Where 'www' is a Debian Jessie-Host, produces this output:

TASK: [sbitmedia.fail2ban | Ensure apt packages] ****************************** 
ok: [www.p6c.org] => (item=fail2ban)

TASK: [sbitmedia.fail2ban | Ensure yum packages] ****************************** 
skipping: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Ensure fail2ban.conf] ***************************** 
ok: [www.p6c.org] => (item=/etc/ansible/roles/sbitmedia.fail2ban/files/fail2ban.conf.Debian)

TASK: [sbitmedia.fail2ban | Set overrides for fail2ban.conf in fail2ban.local] *** 
ok: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Ensure jail.conf] ********************************* 
ok: [www.p6c.org] => (item=/etc/ansible/roles/sbitmedia.fail2ban/files/jail.conf.Debian)

TASK: [sbitmedia.fail2ban | Ensure fail2ban parts directory] ****************** 
ok: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Set overrides for jail.conf in jail.local] ******** 
ok: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Ensure service is started/stopped] **************** 
ok: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Configure fail2ban service in Monit] ************** 
skipping: [www.p6c.org]

TASK: [sbitmedia.fail2ban | Configure fail2ban service in Munin] ************** 
skipping: [www.p6c.org]

TASK: [apt name=fail2ban state=latest] **************************************** 
ok: [www.p6c.org]

TASK: [fail2ban_jail ] ******************************************************** 
failed: [www.p6c.org] => {"failed": true, "parsed": false}

FATAL: all hosts have already failed -- aborting

Once I also got this error (though I can't reproduce it):

module is missing interpreter line

This looks like a bug in the fail2ban role to me; if not, a better error message would be much appreciated.

This is with ansible 1.7.2 on Ubuntu 14.04

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.