143 lines
5.3 KiB
YAML
143 lines
5.3 KiB
YAML
---
|
|
# ============================================
|
|
# Fail2Ban Installation et configuration
|
|
# ============================================
|
|
- name: Installation et configuration de Fail2Ban
|
|
hosts: uber-stup
|
|
become: true
|
|
gather_facts: true
|
|
|
|
vars:
|
|
fail2ban_bantime: "1h"
|
|
fail2ban_findtime: "10m"
|
|
fail2ban_maxretry: 5
|
|
fail2ban_ignoreip: "127.0.0.1/8 ::1"
|
|
|
|
tasks:
|
|
# ============================================================
|
|
# Installation
|
|
# ============================================================
|
|
- name: Installer Fail2Ban
|
|
ansible.builtin.apt:
|
|
name: fail2ban
|
|
state: present
|
|
update_cache: yes
|
|
|
|
# ============================================================
|
|
# Configuration globale (jail.local)
|
|
# ============================================================
|
|
- name: Créer jail.local avec la configuration globale
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[DEFAULT]
|
|
ignoreip = {{ fail2ban_ignoreip }}
|
|
bantime = {{ fail2ban_bantime }}
|
|
findtime = {{ fail2ban_findtime }}
|
|
maxretry = {{ fail2ban_maxretry }}
|
|
banaction = iptables-multiport
|
|
backend = systemd
|
|
loglevel = INFO
|
|
|
|
# ============================================================
|
|
# SSH
|
|
# ============================================================
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
filter = sshd
|
|
logpath = %(sshd_log)s
|
|
maxretry = 3
|
|
bantime = 24h
|
|
|
|
# ============================================================
|
|
# Nginx - requêtes trop fréquentes (rate limit)
|
|
# ============================================================
|
|
[nginx-limit-req]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-limit-req
|
|
logpath = /var/log/nginx/error.log
|
|
maxretry = 10
|
|
bantime = 1h
|
|
|
|
# ============================================================
|
|
# Nginx - 4xx répétés (scan, bot)
|
|
# ============================================================
|
|
[nginx-http-auth]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-http-auth
|
|
logpath = /var/log/nginx/error.log
|
|
maxretry = 5
|
|
bantime = 1h
|
|
|
|
# ============================================================
|
|
# Nginx - bad bots / scans (404 répétés)
|
|
# ============================================================
|
|
[nginx-botsearch]
|
|
enabled = true
|
|
port = http,https
|
|
filter = nginx-botsearch
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 10
|
|
bantime = 2h
|
|
|
|
# ============================================================
|
|
# API Backend - brute force login (POST /api/v2/login)
|
|
# ============================================================
|
|
[backend-login]
|
|
enabled = true
|
|
port = http,https
|
|
filter = backend-login
|
|
logpath = /var/log/nginx/access.log
|
|
maxretry = 10
|
|
findtime = 5m
|
|
bantime = 2h
|
|
notify: Restart fail2ban
|
|
|
|
# ============================================================
|
|
# Filtre personnalisé - brute force login API
|
|
# ============================================================
|
|
- name: Créer le filtre fail2ban pour le login API
|
|
ansible.builtin.copy:
|
|
dest: /etc/fail2ban/filter.d/backend-login.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
content: |
|
|
[Definition]
|
|
failregex = ^<HOST> .* "POST /api/v2/login HTTP/.*" (401|403) .*$
|
|
ignoreregex =
|
|
notify: Restart fail2ban
|
|
|
|
# ============================================================
|
|
# Démarrage et activation
|
|
# ============================================================
|
|
- name: Démarrer et activer Fail2Ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: started
|
|
enabled: yes
|
|
|
|
# ============================================================
|
|
# Vérification
|
|
# ============================================================
|
|
- name: Vérifier le statut de Fail2Ban
|
|
ansible.builtin.command: fail2ban-client status
|
|
register: fail2ban_status
|
|
changed_when: false
|
|
|
|
- name: Afficher le statut des jails
|
|
ansible.builtin.debug:
|
|
msg: "{{ fail2ban_status.stdout_lines }}"
|
|
|
|
handlers:
|
|
- name: Restart fail2ban
|
|
ansible.builtin.systemd:
|
|
name: fail2ban
|
|
state: restarted
|