refactor: update fail2ban

- change banaction to ufw - add findtime as variable
MVladislav · Sep 26, 2024 · 1dca840 · 1dca840
1 parent e6bad7f
commit 1dca840
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -93,9 +93,10 @@ security_auditd_conf_variables:
 # ------------------------------------------------------------------------------
 # template jail.local.j2
 security_jail_bantime: 3600
-security_jail_banaction: iptables-allports # iptables-allports | iptables-multiport
+security_jail_banaction: ufw # ufw | iptables-allports | iptables-multiport
 security_jail_enabled: true
 security_jail_maxretry: 3
+security_jail_findtime: 300
 security_jail_backend: systemd # auto | systemd
 
 security_fail2ban_proxmox: false

diff --git a/templates/jail.local.j2 b/templates/jail.local.j2
@@ -1,6 +1,6 @@
 [DEFAULT]
 # Prevents banning Local (LAN subnets)
-ignoreip = 127.0.0.1/8
+ignoreip = 127.0.0.1/8 ::1
 #           10.0.0.0/8
 #           192.168.0.0/16
 #           172.16.0.0/12
@@ -14,7 +14,7 @@ bantime = {{ security_jail_bantime }}
 maxretry = {{ security_jail_maxretry }}
 
 # A host is banned if it has generated "maxretry" during the last "findtime" seconds.
-findtime = 300
+findtime = {{ security_jail_findtime }}
 
 allowipv6 = auto