89 lines
2.1 KiB
YAML
89 lines
2.1 KiB
YAML
---
|
|
- name: Sécurité Simple - Réseau local libre, extérieur protégé
|
|
hosts: all
|
|
become: yes
|
|
|
|
tasks:
|
|
- name: "=== Installation ==="
|
|
apt:
|
|
name:
|
|
- ufw
|
|
- fail2ban
|
|
state: present
|
|
update_cache: yes
|
|
|
|
- name: "=== FIREWALL ==="
|
|
debug:
|
|
msg: "Configuration du firewall..."
|
|
|
|
- name: Règles par défaut UFW
|
|
ufw:
|
|
default: "{{ item.direction }}"
|
|
direction: "{{ item.type }}"
|
|
loop:
|
|
- { direction: 'deny', type: 'incoming' }
|
|
- { direction: 'allow', type: 'outgoing' }
|
|
|
|
- name: SSH autorisé (pour ne pas se bloquer)
|
|
ufw:
|
|
rule: allow
|
|
port: '22'
|
|
proto: tcp
|
|
|
|
- name: Tout le réseau local autorisé
|
|
ufw:
|
|
rule: allow
|
|
from_ip: 192.168.123.0/24
|
|
|
|
- name: Activer UFW
|
|
ufw:
|
|
state: enabled
|
|
|
|
- name: "=== FAIL2BAN ==="
|
|
debug:
|
|
msg: "Configuration de Fail2ban..."
|
|
|
|
- name: Configuration Fail2ban simple
|
|
copy:
|
|
dest: /etc/fail2ban/jail.local
|
|
content: |
|
|
[DEFAULT]
|
|
bantime = 3600
|
|
findtime = 600
|
|
maxretry = 5
|
|
|
|
[sshd]
|
|
enabled = true
|
|
port = ssh
|
|
logpath = /var/log/auth.log
|
|
maxretry = 3
|
|
mode: '0644'
|
|
|
|
- name: Démarrer Fail2ban
|
|
systemd:
|
|
name: fail2ban
|
|
state: restarted
|
|
enabled: yes
|
|
|
|
- name: "=== VÉRIFICATION ==="
|
|
command: ufw status
|
|
register: fw_status
|
|
changed_when: false
|
|
|
|
- name: Afficher config
|
|
debug:
|
|
var: fw_status.stdout_lines
|
|
|
|
- name: "=== RÉSUMÉ ==="
|
|
debug:
|
|
msg:
|
|
- "================================================"
|
|
- "✓ FIREWALL"
|
|
- " Depuis 192.168.123.0/24 → TOUS LES PORTS OK"
|
|
- " Depuis Internet → BLOQUÉ"
|
|
- ""
|
|
- "✓ FAIL2BAN"
|
|
- " 3 tentatives SSH ratées → Ban 1h"
|
|
- ""
|
|
- "✓ VOUS ÊTES PROTÉGÉ !"
|
|
- "================================================" |