diff options
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/security/files/600.clean-pf | 28 | ||||
| -rw-r--r-- | roles/security/tasks/main.yml | 21 |
2 files changed, 7 insertions, 42 deletions
diff --git a/roles/security/files/600.clean-pf b/roles/security/files/600.clean-pf deleted file mode 100644 index 9ecf42c..0000000 --- a/roles/security/files/600.clean-pf +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/sh -# -# Clean up PF tables ... -# - -if [ -r /etc/defaults/periodic.conf ] -then - . /etc/defaults/periodic.conf - source_periodic_confs -fi - -case "$daily_clean_pf_enable" in - [Yy][Ee][Ss]) - echo "" - echo "PF tables cleanup:" - : ${daily_clean_pf_expire:=86400} - for table in $daily_clean_pf_tables; do - echo "Cleanup table $table ..." - pfctl -v -t $table -T expire $daily_clean_pf_expire - rc=$? - done - ;; - *) - rc=0 - ;; -esac - -exit $rc diff --git a/roles/security/tasks/main.yml b/roles/security/tasks/main.yml index 043792f..e72a79d 100644 --- a/roles/security/tasks/main.yml +++ b/roles/security/tasks/main.yml @@ -21,17 +21,10 @@ notify: restart-syslogd tags: sshlockout -- name: periodic - copy clean-pf script - copy: - src: 600.clean-pf - dest: /etc/periodic/daily/600.clean-pf - mode: 0755 - -- name: periodic - enable clean-pf - blockinfile: - path: /etc/periodic.conf - marker: '# {mark} ANSIBLE MANAGED - clean-pf' - block: | - # Clean up PF tables - daily_clean_pf_enable="YES" - daily_clean_pf_tables="bruteforce" +- name: cron - expire PF table (bruteforce) + cron: + name: "pf-expire-table-bruteforce" + user: root + minute: "0" + hour: "*/2" # every 2 hours + job: "pfctl -t bruteforce -T expire 86400 >/dev/null" |