LICENSE.md

 Copyright 2021, Technische Universität Dresden
+
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
-Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
 
-Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
 
-Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
 
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

README.md

-## Description
-
-A brief description of the role goes here.
-
-## Requirements
-
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
-
-### Roles
-
-A list of required roles. Parent roles must not be listed.
-
-### Variables
-
-A list of all role variables.
-Changed variable of parent roles must be listed too.
-
-### Plugins
-
-## Processes
-
-A rough overview of the steps.
-
-### <task list>
-1. <step 1>
-2. ..
-
-## Features
-
-A detailed description of roles features
-
-## License
-
-BSD-3-Clauses
-
-## Contributors 
-
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
-- firstname lastname <e-mail-address>
+Description
+===========
+
+This role configures fail2ban.
+
+Requirements
+============
+
+Roles
+-----
+
+Only Parent roles.
+
+Variables
+---------
+
+* fail2ban_loglevel:
+    * description:
+        * sets the loglevel output
+    * default: `INFO`
+    * choices: [`1 = ERROR`, `2 = WARN`, `3 = INFO`, `4 = DEBUG`]
+
+* fail2ban_logtarget:
+    * description:
+        * Sets the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+    * default: `/var/log/fail2ban.log`
+
+* fail2ban_syslog_target:
+    * description:
+        * Sets the syslog target instance.
+    * default: `/var/log/fail2ban.log`
+
+* fail2ban_syslog_facility:
+    * description:
+        * tbd...
+    * default: `1`
+    
+* fail2ban_socket:
+    * description:
+        * Sets the socket file, which is used to communicate with the daemon.
+    * default: `/var/run/fail2ban/fail2ban.sock`
+
+* fail2ban_pidfile:
+    * description:
+        * Sets the pid file, which is used to to store the process ID of the daemon (Only works on `fail2ban >= 0.8.9`).
+    * default: `/var/run/fail2ban/fail2ban.pid`
+
+* fail2ban_ignoreips:
+    * description:
+        * Which IP address/CIDR mask/DNS host should be ignored from fail2ban's actions.
+    * default: `[127.0.0.1/8]`
+
+* fail2ban_bantime:
+    * description:
+        * Sets the bantime in seconds.
+    * default: `600`
+
+* fail2ban_maxretry:
+    * description:
+        * Maximum number of retries before the host is put into jail.
+    * default: `3`
+
+* fail2ban_findtime:
+    * description:
+        * A host is banned if it has generated `fail2ban_maxretry` during the last `fail2ban_findtime` in seconds.
+    * default: `600`
+
+* fail2ban_backend:
+    * description:
+        * Specifies the backend used to get files modification.
+    * default: `auto`
+    * choices: tbd...
+
+* fail2ban_banaction:
+    * description:
+        * Sets the global/default banaction.
+    * default: `iptables-multiport`
+
+* fail2ban_protocol:
+    * description:
+        * Sets the default protocol.
+    * default: `tcp`
+    * choices: tbd...
+
+* fail2ban_chain:
+    * description:
+        * Specifies the chain where jumps would need to be added in iptables-* actions.
+    * default: `INPUT`
+
+* fail2ban_action:
+    * description:
+        * Default action. **Note that variables (including the actions defined elsewhere in the config files) must be wrapped in python-style `%(` and `)s` so they are expanded**.
+    * default: `%(action_)s`
+
+* fail2ban_services:
+    * description:
+        * Service definitions.
+    * default see `defaults/main.yml`
+
+* fail2ban_services.{n}.name [required]:
+    * description:
+        * Service name.
+    * default: undefined
+    * example:  `sshd`, `ssh`
+
+* fail2ban_services.{n}.enabled:
+    * description:
+        * Whether or not enabled.
+    * default: `true`
+    * choices: `true`, `false`
+
+* fail2ban_services.{n}.\* [optional]:
+    * description:
+        * Name of the option
+
+* fail2ban_services.{n}.\*.\* [optional]:
+    * description:
+        * Value of the option
+
+Processes
+=========
+
+configure
+---------
+
+1. create configuration files from templates
+
+License
+=======
+
+BSD-3-Clause
+
+Contributors
+============
+
+* Michael Klix (michael.klix@tu-dresden.de)
+
+Based on the provided SDM framework of
+* Martin Pietsch (martin.pietsch@tu-dresden.de)
+
+Mainly influenced by the implementation/example of Nicolas Bigot <https://github.com/nbigot/ansible-fail2ban>.
+
+Literature
+==========
+
+* https://fail2ban.org/wiki/index.php/Category:HTTP
+* https://fedoraproject.org/wiki/Fail2ban_with_FirewallD
+* https://computingforgeeks.com/install-and-use-firewalld-on-ubuntu-18-04-ubuntu-16-04
+* https://www.digitalocean.com/community/tutorials/how-to-protect-an-nginx-server-with-fail2ban-on-ubuntu-14-04
+* https://snippets.aktagon.com/snippets/554-how-to-secure-an-nginx-server-with-fail2ban

defaults/main.yml

+# defaults file for fail2ban
 ---
-# defaults file for project-template
+fail2ban_loglevel: INFO
+fail2ban_logtarget: /var/log/fail2ban.log
+fail2ban_syslog_target: /var/log/fail2ban.log
+fail2ban_syslog_facility: 1
+fail2ban_socket: /var/run/fail2ban/fail2ban.sock
+fail2ban_pidfile: /var/run/fail2ban/fail2ban.pid
+fail2ban_ignoreips:
+  - 127.0.0.1/8
+fail2ban_bantime: 600
+fail2ban_maxretry: 3
+fail2ban_findtime: 600
+fail2ban_backend: auto
+fail2ban_banaction: iptables-multiport
+fail2ban_protocol: tcp
+fail2ban_chain: INPUT
+fail2ban_action: '%(action_)s'
+fail2ban_services:
+  - name: sshd
+  - name: nginx-http-auth

handlers/main.yml

 ---
-# handlers file for project-template
+# handlers file for fail2ban

meta/main.yml

+---
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author: Michael Klix (michael.klix@tu-dresden.de)
+  description: This role configures fail2ban.
+  company: Technische Universität Dresden
+  role_name: package_security_fail2ban
+  namespace: sdm
 
-  # If the issue tracker for your role is not on github, uncomment the
-  # next line and provide a value
-  # issue_tracker_url: http://example.com/issue/tracker
+  license: BSD-3-Clause
 
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
+  min_ansible_version: 2.10
 
-  min_ansible_version: 2.1
-
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
-
-  #
-  # Provide a list of supported platforms, and for each platform a list of versions.
-  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
-  # To view available platforms and versions (or releases), visit:
-  # https://galaxy.ansible.com/api/v1/platforms/
-  #
-  # platforms:
-  # - name: Fedora
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
+  platforms:
+    - name: Linux/systemd
+      versions:
+        - all
 
   galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
 
 dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.

molecule/default/converge.yml

 ---
 - name: Converge
   hosts: all
+  vars:
+    system_config_directory: "/etc"
   tasks:
-    - name: "Include project-template"
-      include_role:
-        name: "project-template"
+    - name: "install fail2ban"
+      sdm.oor.call_role:
+        name: package.security.fail2ban
+        tasks: main
+    - name: "configure fail2ban"
+      sdm.oor.call_role:
+        name: package.security.fail2ban
+        tasks: configure

molecule/default/molecule.yml

 ---
 dependency:
   name: galaxy
+  enabled: false
+
 driver:
   name: podman
-lint:
-  name: yamllint
+
 platforms:
-  - name: instance
-    image: docker.io/pycontribs/centos:8
-    pre_build_image: true
+  - name: package_security_fail2ban_debian
+    registry:
+      url: gitlab.mn.tu-dresden.de:8000
+    image: sdmgroup/containers/debian10:latest
+    command: /lib/systemd/systemd
+    pre_build_image: false
+
 provisioner:
   name: ansible
-  lint:
-    name: ansible-lint
-    enabled: True
+  config_options:
+    defaults:
+      callback_whitelist: sdm.oor.sdmoor
+      stdout_callback: sdm.oor.sdmdefault
+      strategy: sdm.oor.sdmlinear
+      vars_plugins_enabled: sdm.common.sdm_host_group_vars
+      deprecation_warnings: false
+      remote_tmp: /tmp
+  playbooks:
+    create: create.yml
+    converge: converge.yml
+    destroy: destroy.yml
+
 verifier:
   name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

tasks/configure.yml

+---
+- name: "call inherited configure tasks"
+  sdm.oor.call_tasks:
+    from: main
+    super: true
+
+- name: "configure fail2ban: update configuration file"
+  ansible.builtin.template:
+    src: fail2ban.local.j2
+    dest: "{{ '{}/fail2ban/fail2ban.local'.format(system_config_directory) }}"
+    owner: "root"
+    group: "root"
+    mode: 0644
+  notify:
+    - "restart services"
+
+- name: "configure fail2ban: update jail file"
+  ansible.builtin.template:
+    src: jail.local.j2
+    dest: "{{ '{}/fail2ban/jail.local'.format(system_config_directory) }}"
+    owner: "root"
+    group: "root"
+    mode: 0644
+  notify:
+    - "restart services"

tasks/main.yml

----
-# tasks file for project-template

templates/fail2ban.local.j2

+# Overrides values from the fail2ban.conf configuration file.
+#
+# For comments relating to each setting see fail2ban.conf
+
+[Definition]
+
+loglevel = {{ fail2ban_loglevel }}
+logtarget = {{ fail2ban_logtarget }}
+
+{% if fail2ban_logtarget == "SYSLOG" %}
+syslog-target = {{ fail2ban_syslog_target }}
+syslog-facility = {{ fail2ban_syslog_facility }}
+{% endif %}
+
+socket = {{ fail2ban_socket }}
+
+pidfile = {{ fail2ban_pidfile }}

templates/jail.local.j2

+# The DEFAULT allows a global definition of the options. They can be overridden
+# in each jail afterwards.
+
+[DEFAULT]
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host
+ignoreip = {{ fail2ban_ignoreips | join(' ') }}
+bantime  = {{ fail2ban_bantime }}
+maxretry = {{ fail2ban_maxretry }}
+findtime = {{ fail2ban_findtime }}
+
+# "backend" specifies the backend used to get files modification. Available
+# options are "gamin", "polling" and "auto".
+# yoh: For some reason Debian shipped python-gamin didn't work as expected
+#      This issue left ToDo, so polling is default backend for now
+backend = {{ fail2ban_backend }}
+
+#
+# ACTIONS
+#
+
+# Default banning action (e.g. iptables, iptables-new,
+# iptables-multiport, shorewall, etc) It is used to define
+# action_* variables. Can be overridden globally or per
+# section within jail.local file
+banaction = {{ fail2ban_banaction }}
+
+# Default protocol
+protocol = {{ fail2ban_protocol }}
+
+# Specify chain where jumps would need to be added in iptables-* actions
+chain = {{ fail2ban_chain }}
+
+#
+# Action shortcuts. To be used to define action parameter
+
+# The simplest action to take: ban only
+action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# Choose default action.  To change, just override value of 'action' with the
+# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
+# globally (section [DEFAULT]) or per specific section
+action = {{ fail2ban_action }}
+
+#
+# JAILS
+#
+
+# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
+# was shipped in Debian. Enable any defined here jail by including
+#
+# [SECTION_NAME]
+# enabled = true
+
+#
+# in /etc/fail2ban/jail.local.
+#
+# Optionally you may override any other parameter (e.g. banaction,
+# action, port, logpath, etc) in that section within jail.local
+
+
+{% for service in fail2ban_services %}
+[{{ service.name }}]
+enabled = {{ service.enabled | default(true) | bool | to_json }}
+logpath = {{ fail2ban_syslog_target }}
+{% for option, value in service.items()|sort %}
+{% if option not in ['name', 'enabled'] %}
+{{ option }} = {{ value }}
+{% endif %}
+{% endfor %}
+
+{% endfor %}

tests/test.yml

@@ -2,4 +2,4 @@
 - hosts: localhost
   remote_user: root
   roles:
-    - project-template
+    - package.security.fail2ban/

vars/main.yml

 ---
-# vars file for project-template
+# vars file for package.security.fail2ban/
+package_packages: ["fail2ban"]
+package_services: ["fail2ban.service"]