blob: 62c1ac56377d0cfdde5fd58183f302cacd8bfbb7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
|
---
- name: firewall - setup PF rules
template:
src: pf.conf.j2
dest: /etc/pf.conf
validate: "pfctl -nf %s"
notify: reload-pf
tags: pf-rules
- name: firewall - enable PF
command: rcenable pf
- name: firewall - enable PF log
command: rcenable pflog
- name: sshlockout - setup with PF
blockinfile:
path: /etc/syslog.conf
marker: '# {mark} ANSIBLE MANAGED - sshlockout'
block: |
# Block SSH auth failures using "sshlockout" and "pf"
auth.info;authpriv.info |exec /usr/sbin/sshlockout -pf bruteforce
notify: restart-syslogd
- name: periodic - copy clean-pf script
copy:
src: 600.clean-pf
dest: /etc/periodic/daily/600.clean-pf
mode: 0755
- name: periodic - touch config file
file:
path: /etc/periodic.conf
state: touch
mode: 0644
- name: periodic - enable clean-pf
blockinfile:
path: /etc/periodic.conf
marker: '# {mark} ANSIBLE MANAGED - clean-pf'
block: |
# Clean up PF tables
daily_clean_pf_enable="YES"
daily_clean_pf_tables="bruteforce"
|
