EOX GitLab Instance

Skip to content
Snippets Groups Projects

Minor change to avoid an alert on Alpine with allowipv6

Merged Nicolas Baudoin requested to merge f2b-allowipv6-alpine into main
+ 21
1
@@ -20,6 +20,26 @@
@@ -20,6 +20,26 @@
line: '[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$'
line: '[iI](?:llegal|nvalid) user <F-USER>.*?</F-USER> from <HOST>%(__suff)s$'
state: present
state: present
 
# There was an error message with the restart of fail2ban on Alpine systems without that change.
 
# Also, it makes sure ipv6 is being analysed.
 
# Added also this part to remove duplicates of either parts of the block
 
- name: Remove duplicate [Definition] or allowipv6 = yes lines
 
lineinfile:
 
path: /etc/fail2ban/fail2ban.conf
 
regexp: '^\[Definition\]|^allowipv6 = yes$'
 
state: absent
 
 
- name: Ensure [Definition] section with allowipv6 = yes is present with an extra empty line below [Thread]
 
blockinfile:
 
path: /etc/fail2ban/fail2ban.conf
 
block: |
 
[Definition]
 
 
allowipv6 = yes
 
 
marker: "# {mark} ANSIBLE MANAGED BLOCK"
 
insertbefore: '^\[Thread\]'
 
# Updating fail2ban to be able to work with the way our nftables work
# Updating fail2ban to be able to work with the way our nftables work
- name: Deploy custom nftables action for Fail2Ban
- name: Deploy custom nftables action for Fail2Ban
template:
template:
@@ -41,4 +61,4 @@
@@ -41,4 +61,4 @@
name: "Update logpath and reload fail2ban at midnight"
name: "Update logpath and reload fail2ban at midnight"
minute: "0"
minute: "0"
hour: "0"
hour: "0"
job: 'sleep 5 && /usr/local/bin/current_date_logpath && {% if ansible_os_family == "Alpine" %}service fail2ban restart{% else %}systemctl reload fail2ban{% endif %}'
job: 'sleep 5 && /usr/local/bin/current_date_logpath && fail2ban-client reload > /dev/null'
Loading