From 6973fb536f625b145092c5f0b437753d8aaff768 Mon Sep 17 00:00:00 2001 From: Jake Howard Date: Sun, 28 Mar 2021 13:05:31 +0100 Subject: [PATCH] Add fail2ban for traefik Remote action coming soon --- ansible/host_vars/casey.yml | 1 + ansible/host_vars/pve-docker.yml | 2 ++ ansible/main.yml | 1 + ansible/roles/base/defaults/main.yml | 1 + ansible/roles/base/files/sshd_config | 2 +- ansible/roles/fail2ban_ssh/defaults/main.yml | 1 + .../fail2ban_ssh/files/f2b-entrypoint.sh | 8 ++++++ ansible/roles/fail2ban_ssh/tasks/main.yml | 27 +++++++++++++++++++ ansible/roles/traefik/defaults/main.yml | 1 + .../roles/traefik/files/docker-compose.yml | 1 + .../files/fail2ban/traefik-filter.conf | 4 +++ .../traefik/files/fail2ban/traefik-jail.conf | 9 +++++++ ansible/roles/traefik/files/logrotate.conf | 8 ++++++ ansible/roles/traefik/files/traefik.yml | 6 +++++ ansible/roles/traefik/handlers/main.yml | 6 +++++ ansible/roles/traefik/tasks/fail2ban.yml | 15 +++++++++++ ansible/roles/traefik/tasks/main.yml | 11 ++++++++ 17 files changed, 103 insertions(+), 1 deletion(-) create mode 100644 ansible/roles/base/defaults/main.yml create mode 100644 ansible/roles/fail2ban_ssh/defaults/main.yml create mode 100644 ansible/roles/fail2ban_ssh/files/f2b-entrypoint.sh create mode 100644 ansible/roles/fail2ban_ssh/tasks/main.yml create mode 100644 ansible/roles/traefik/files/fail2ban/traefik-filter.conf create mode 100644 ansible/roles/traefik/files/fail2ban/traefik-jail.conf create mode 100644 ansible/roles/traefik/files/logrotate.conf create mode 100644 ansible/roles/traefik/tasks/fail2ban.yml diff --git a/ansible/host_vars/casey.yml b/ansible/host_vars/casey.yml index 5416696..e1b093a 100644 --- a/ansible/host_vars/casey.yml +++ b/ansible/host_vars/casey.yml @@ -1 +1,2 @@ nebula_is_lighthouse: true +ssh_extra_allowed_users: f2b@{{ nebula.cidr }} f2b@{{ pve_hosts.internal_cidr }} diff --git a/ansible/host_vars/pve-docker.yml b/ansible/host_vars/pve-docker.yml index a6dbb2c..6ffa9ce 100644 --- a/ansible/host_vars/pve-docker.yml +++ b/ansible/host_vars/pve-docker.yml @@ -3,3 +3,5 @@ private_ip: "{{ pve_hosts.pve_docker.ip }}" traefik_provider_jellyfin: true traefik_provider_homeassistant: true traefik_provider_grafana: true + +with_fail2ban: true diff --git a/ansible/main.yml b/ansible/main.yml index 44070c4..8c719ba 100644 --- a/ansible/main.yml +++ b/ansible/main.yml @@ -8,6 +8,7 @@ roles: - gateway - nebula + - fail2ban_ssh - hosts: - pve diff --git a/ansible/roles/base/defaults/main.yml b/ansible/roles/base/defaults/main.yml new file mode 100644 index 0000000..ea6f5f3 --- /dev/null +++ b/ansible/roles/base/defaults/main.yml @@ -0,0 +1 @@ +ssh_extra_allowed_users: "" diff --git a/ansible/roles/base/files/sshd_config b/ansible/roles/base/files/sshd_config index cede24c..4a69245 100644 --- a/ansible/roles/base/files/sshd_config +++ b/ansible/roles/base/files/sshd_config @@ -2,7 +2,7 @@ # Change to a high/odd port if this server is exposed to the internet directly Port {{ ssh_port }} -AllowUsers {% if ansible_hostname in pve_hosts %}{{ user }}@{{ pve_hosts.internal_cidr }}{% endif %} {% if ansible_hostname in nebula.clients %}{{ user }}@{{ nebula.cidr }}{% endif %} +AllowUsers {% if ansible_hostname in pve_hosts %}{{ user }}@{{ pve_hosts.internal_cidr }}{% endif %} {% if ansible_hostname in nebula.clients %}{{ user }}@{{ nebula.cidr }}{% endif %} {{ ssh_extra_allowed_users }} # Bind to all interfaces (change to specific interface if needed) ListenAddress 0.0.0.0 diff --git a/ansible/roles/fail2ban_ssh/defaults/main.yml b/ansible/roles/fail2ban_ssh/defaults/main.yml new file mode 100644 index 0000000..48ce2a0 --- /dev/null +++ b/ansible/roles/fail2ban_ssh/defaults/main.yml @@ -0,0 +1 @@ +f2b_user: f2b diff --git a/ansible/roles/fail2ban_ssh/files/f2b-entrypoint.sh b/ansible/roles/fail2ban_ssh/files/f2b-entrypoint.sh new file mode 100644 index 0000000..ccfe93c --- /dev/null +++ b/ansible/roles/fail2ban_ssh/files/f2b-entrypoint.sh @@ -0,0 +1,8 @@ +#!/usr/bin/env bash + +set -e + +# Remove `-c` argument +shift + +sudo fail2ban-client $@ diff --git a/ansible/roles/fail2ban_ssh/tasks/main.yml b/ansible/roles/fail2ban_ssh/tasks/main.yml new file mode 100644 index 0000000..5da9cc7 --- /dev/null +++ b/ansible/roles/fail2ban_ssh/tasks/main.yml @@ -0,0 +1,27 @@ +- name: Make user + user: + name: "{{ f2b_user }}" + comment: "{{ name }}" + shell: /home/{{ f2b_user }}/f2b-entrypoint.sh + system: false + become: true + +- name: Give user sudo access to client + lineinfile: + path: /etc/sudoers + line: "{{ f2b_user }} ALL=(ALL) NOPASSWD: /usr/bin/fail2ban-client" + become: true + +- name: Allow custom shell + lineinfile: + path: /etc/shells + line: /home/{{ f2b_user }}/f2b-entrypoint.sh + become: true + +- name: Create entrypoint + template: + src: files/f2b-entrypoint.sh + dest: /home/{{ f2b_user }}/f2b-entrypoint.sh + mode: 0755 + become: true + register: sshd_config diff --git a/ansible/roles/traefik/defaults/main.yml b/ansible/roles/traefik/defaults/main.yml index b13e5c2..87d632c 100644 --- a/ansible/roles/traefik/defaults/main.yml +++ b/ansible/roles/traefik/defaults/main.yml @@ -3,3 +3,4 @@ traefik_provider_homeassistant: false traefik_provider_grafana: false with_traefik_pages: false +with_fail2ban: false diff --git a/ansible/roles/traefik/files/docker-compose.yml b/ansible/roles/traefik/files/docker-compose.yml index 631eb34..1080608 100644 --- a/ansible/roles/traefik/files/docker-compose.yml +++ b/ansible/roles/traefik/files/docker-compose.yml @@ -8,5 +8,6 @@ services: - CF_DNS_API_TOKEN={{ cloudflare_api_token }} volumes: - /var/run/docker.sock:/var/run/docker.sock:ro + - /tmp/traefik-logs:/var/log/traefik - ./traefik:/etc/traefik restart: unless-stopped diff --git a/ansible/roles/traefik/files/fail2ban/traefik-filter.conf b/ansible/roles/traefik/files/fail2ban/traefik-filter.conf new file mode 100644 index 0000000..4f670ca --- /dev/null +++ b/ansible/roles/traefik/files/fail2ban/traefik-filter.conf @@ -0,0 +1,4 @@ +[Definition] +failregex = ^ \- \S+ \[\] \"(GET|POST|HEAD) .+\" .+$ +ignoreregex = +mode = normal diff --git a/ansible/roles/traefik/files/fail2ban/traefik-jail.conf b/ansible/roles/traefik/files/fail2ban/traefik-jail.conf new file mode 100644 index 0000000..ab6137e --- /dev/null +++ b/ansible/roles/traefik/files/fail2ban/traefik-jail.conf @@ -0,0 +1,9 @@ +[traefik] +enabled = true +bantime = 6000 +findtime = 600 +maxretry = 5 +filter = traefik +logpath = /tmp/traefik-logs/access.log +port = http,https +ignoreip = {{ wireguard.cidr }},{{ nebula.cidr }},{{ pve_hosts.internal_cidr }} diff --git a/ansible/roles/traefik/files/logrotate.conf b/ansible/roles/traefik/files/logrotate.conf new file mode 100644 index 0000000..4b98916 --- /dev/null +++ b/ansible/roles/traefik/files/logrotate.conf @@ -0,0 +1,8 @@ +/tmp/traefik-logs/access.log { + daily + rotate 7 + missingok + compress + nodateext + notifempty +} diff --git a/ansible/roles/traefik/files/traefik.yml b/ansible/roles/traefik/files/traefik.yml index 1b5e824..7a79df3 100644 --- a/ansible/roles/traefik/files/traefik.yml +++ b/ansible/roles/traefik/files/traefik.yml @@ -77,3 +77,9 @@ tls: pilot: dashboard: false + +accessLog: + filePath: "/var/log/traefik/access.log" + filters: + statusCodes: + - "400-600" diff --git a/ansible/roles/traefik/handlers/main.yml b/ansible/roles/traefik/handlers/main.yml index 699f0fd..39e4f13 100644 --- a/ansible/roles/traefik/handlers/main.yml +++ b/ansible/roles/traefik/handlers/main.yml @@ -2,3 +2,9 @@ shell: chdir: /opt/traefik cmd: "{{ docker_update_command }}" + +- name: restart fail2ban + service: + name: fail2ban + state: restarted + become: true diff --git a/ansible/roles/traefik/tasks/fail2ban.yml b/ansible/roles/traefik/tasks/fail2ban.yml new file mode 100644 index 0000000..a767fa5 --- /dev/null +++ b/ansible/roles/traefik/tasks/fail2ban.yml @@ -0,0 +1,15 @@ +- name: Create jail + template: + src: files/fail2ban/traefik-jail.conf + dest: /etc/fail2ban/jail.d/traefik.conf + mode: 0644 + become: true + notify: restart fail2ban + +- name: Create filter + template: + src: files/fail2ban/traefik-filter.conf + dest: /etc/fail2ban/filter.d/traefik.conf + mode: 0644 + become: true + notify: restart fail2ban diff --git a/ansible/roles/traefik/tasks/main.yml b/ansible/roles/traefik/tasks/main.yml index b22ab76..64b4074 100644 --- a/ansible/roles/traefik/tasks/main.yml +++ b/ansible/roles/traefik/tasks/main.yml @@ -77,3 +77,14 @@ notify: restart traefik when: traefik_provider_grafana become: true + +- name: logrotate config + template: + src: files/logrotate.conf + dest: /etc/logrotate.d/traefik + mode: "0600" + become: true + +- name: fail2ban + include: fail2ban.yml + when: with_fail2ban