diff options
| author | Aaron LI <aly@aaronly.me> | 2018-03-03 10:58:59 +0800 |
|---|---|---|
| committer | Aaron LI <aly@aaronly.me> | 2018-03-14 11:35:07 +0800 |
| commit | 02af593780427be8a8109517bab3450859425e49 (patch) | |
| tree | d542184e5c362e62aad61c7c90f5ee2142782d56 /roles/security/tasks | |
| parent | 252cab20ab941ea3c2ee7e954ef0e0d943f63b75 (diff) | |
| download | ansible-dfly-vps-02af593780427be8a8109517bab3450859425e49.tar.bz2 | |
Add security role: PF firewall, sshlockout
Diffstat (limited to 'roles/security/tasks')
| -rw-r--r-- | roles/security/tasks/main.yml | 41 |
1 files changed, 41 insertions, 0 deletions
diff --git a/roles/security/tasks/main.yml b/roles/security/tasks/main.yml new file mode 100644 index 0000000..0a7ef0f --- /dev/null +++ b/roles/security/tasks/main.yml @@ -0,0 +1,41 @@ +--- +- name: firewall - setup PF rules + template: + src: pf.conf.j2 + dest: /etc/pf.conf + validate: "pfctl -nf %s" + +- name: firewall - enable PF + command: rcenable pf + +- name: firewall - enable PF log + command: rcenable pflog + +- name: sshlockout - setup with PF + blockinfile: + path: /etc/syslog.conf + marker: '# {mark} ANSIBLE MANAGED - sshlockout' + block: | + # Block SSH auth failures using "sshlockout" and "pf" + auth.info;authpriv.info |exec /usr/sbin/sshlockout -pf bruteforce + +- name: periodic - copy clean-pf script + copy: + src: 600.clean-pf + dest: /etc/periodic/daily/600.clean-pf + mode: 0755 + +- name: periodic - touch config file + file: + path: /etc/periodic.conf + state: touch + mode: 0644 + +- name: periodic - enable clean-pf + blockinfile: + path: /etc/periodic.conf + marker: '# {mark} ANSIBLE MANAGED - clean-pf' + block: | + # Clean up PF tables + daily_clean_pf_enable="YES" + daily_clean_pf_tables="bruteforce" |