fail2ban_rhel

A small role to deploy a lean fail2ban configuration on RHEL/Rocky 9+ hosts. Currently supports a templated sshd jail.

Requirements

Target hosts must be RHEL-family or Rocky Linux 9+

Supported Platforms

RHEL 9+
Rocky Linux 9+

Defaults

The role exposes flat defaults for the sshd jail. These values are assembled into the internal fail2ban_rhel_jail_sshd mapping in vars/main.yml and then rendered into /etc/fail2ban/jail.d/sshd.local.

Variable	Default	Description
`fail2ban_rhel_jail_sshd_enabled`	`true`	Enable the `sshd` jail.
`fail2ban_rhel_jail_sshd_port`	`ssh`	Port or service name watched by the jail.
`fail2ban_rhel_jail_sshd_findtime`	`600`	Time window, in seconds, used when counting failures.
`fail2ban_rhel_jail_sshd_maxretry`	`5`	Number of failures allowed within `findtime`.
`fail2ban_rhel_jail_sshd_bantime`	`3600`	Ban duration, in seconds.
`fail2ban_rhel_jail_sshd_logpath`	`%(sshd_log)s`	Fail2Ban's platform default SSH log path token.
`fail2ban_rhel_jail_sshd_backend`	`%(sshd_backend)s`	Fail2Ban's platform default SSH backend token.
`fail2ban_rhel_jail_sshd_banaction`	`firewallcmd-multiport`	Ban action used by the jail.
`fail2ban_rhel_jail_sshd_ignoreips`	`127.0.0.1/8`, `::1`	IPs and CIDRs that should never be banned.

Internal Vars

vars/main.yml builds the fail2ban_rhel_jail_sshd dictionary consumed by the sshd.conf.j2 template:

fail2ban_rhel_jail_sshd:
  enabled: "{{ fail2ban_rhel_jail_sshd_enabled }}"
  port: "{{ fail2ban_rhel_jail_sshd_port }}"
  findtime: "{{ fail2ban_rhel_jail_sshd_findtime }}"
  maxretry: "{{ fail2ban_rhel_jail_sshd_maxretry }}"
  bantime: "{{ fail2ban_rhel_jail_sshd_bantime }}"
  logpath: "{{ fail2ban_rhel_jail_sshd_logpath }}"
  backend: "{{ fail2ban_rhel_jail_sshd_backend }}"
  banaction: "{{ fail2ban_rhel_jail_sshd_banaction }}"
  ignoreips: "{{ fail2ban_rhel_jail_sshd_ignoreips }}"

Override the flat defaults, not the internal mapping, unless you intentionally want to replace the rendered jail data.

Behavior

By default this role:

installs epel-release
installs fail2ban
renders /etc/fail2ban/jail.d/sshd.local from templates/sshd.conf.j2
restarts and enables fail2ban when the rendered jail changes

Example Playbook

- name: Converge
  hosts: all
  roles:
    - role: genlab.common.fail2ban_rhel
      fail2ban_rhel_jail_sshd_maxretry: 4
      fail2ban_rhel_jail_sshd_bantime: 7200

See also: molecule/default/converge.yml

License

MIT

2.6 KiB Raw Blame History