roles/enable_modules/vars/main.yml

+---
+source_dir: /tmp
+lmoddir: /opt/lmod
+modulecmddir: /usr/share
+lmod_version: 5.8.6

roles/enable_root/tasks/main.yml

-- name: add key to root ssh
-  template: dest=/root/.ssh/authorized_keys mode=600 owner=root group=root src=authorized_keys.j2
-  sudo: true

roles/enable_root/templates/authorized_keys.j2

-no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ec2-user\" rather than the user \"root\".';echo;sleep 10" ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAt/cu47VucrAcmE8T+W4IiBQhZvzSQWaG8ORmEx+OV6d7JmeHtdpLrducKywIkdRJAh2KFsXawewFcYCoBgWRzBon7vZqcECY0Lu6uuQiPtfdAHDwBZpt7WD67UGU9m4eJXTOfVc0T9W/igwiofSt7XAlSrOSpuxyrwaNiFmZhWXOy61AGioSVCuOijzVUZHTJ2gIBx433+Y7TzCSP0LXlEypYxAsYnIeRtiiINRRCHSehUBmi9mnp+Y6J/LUg0CN2bJaoq4Zj/elGCflh4s/69w8vH7JpzqP1yzH0AFXS2C8l1Hs9SXTA2a4XrqJYg/JqP8j8lJXy+b28y6WgBBvVQ== jupiter@cvlproject.monash.edu
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDPijQ597uLqEPAvVZXQlSjrUfFl2h7SRBTCRhH4hQJMVu55dhFYiojJZ0tjjV3jTcgWs1AsyRp3wDtNp8iQxbwEY2JPxCOjNuH0et4I/y3y6VUjcVWanSaIkdPf5AFNb9KIXo3Hvdyvav8SfFpioRQ0FKp8SZs1JYXpuQ0mZY26oKCKcNsWXv9ZN7knUN0xvYNMycpCnI2Nl666Zrs0gGyJ6e+Xq5bpk1lm8nuK9q52bTRjxqtdEBuSGwkZea+NBJzpYw5rEucteQI66y6tzFuYJk2WC4bUifffIxnkQXKYVynJg1MJ2CGI69r9hXt9eUtH3WrDxrJGmCau8jD3lib hines@sparge
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAnakq6Lgq2n6yjcMaC7xQXMDMRdN33T6mPCqRy+TPdu0aPvVty0UFeAWsCyTxHeVfst9Vr0HwRRBvNihp1CJuOWGbk0H5a8yALDhLqoHazv2jlMQcLDgTktw0Jgo38+tcBShJyey1iHh8X5WgsS5/hgxR3OzoNBEzqzHUidMO/EI0ahNlM60l8EYL8Ww799NmPgqdPbwxK9nHsoFmx/NKhnUdronSg33L0CJZT3t2fccXAq+4Pbm7uYEkL3T/NgMdgpG5mKS3mKDtKyyKm2gOf3fVzExFew2etBxB3ANPEWvSuJ2XwXQv8sFE1722XQVR4RFgilCWUqXSN7EmqoHkNQ== jupiter@cvlproject
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAsBtPRJtDJzyW+Utu0v03wklUpvzS5c1E34ysGDMepGU8VT1phJQ2EwRPWVLdRjVHnuhrEeeUHMyQwOtLEdvTPFnw5u/4bHQ+37iwtAeTV6oyPARJVzJLRGuDUuFdkQbXN7xxi/0KUljWgswLN34UV+p5PL79kQlErh1QCN06z5k=
-
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA2xrAkFRdYBpYs14AYSzdPFcIOt2zKXIgjPpyj/6eg/yl3y8N84T9VNw9ATRzb3+PJEw1lOfah6xLkFl7FueT6359y14c7wkNByGHgcL022SludkhM2zBe/3ebhcBs11L4Z725rqVnGDSKdKuwZjbCmUtu/nHwGYU/BnLKbQXMVyq53L5cbIyWGfvItPnwCF2ZMy1v0lmnFs1O3qDK9U/qcwc/77MTB0Z/ey0zsoXvmxjkdYr+zgQLRNm2+fkCXn+ZorbeDwWjhHE21arhMym5x3VG0XU2Ob9nL1Z2xEGQVSnBVWeadTMNzkfM8U07Md2tSOIC5B3ePETxk97puxbEQ== root@m2-m
-
-ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEApJTDPfappcYbNE3Z0+5Vsm4Sw2xD3PdcW+V1w6X6tpebG/bpUhnn9XsALkZYyKttql2vV3bqL6Fx5ZAFhHRhH0exdQEgc8hSvpX5gCCCUNqrL+mP8f4S59E0ha5+nBmMaf4WABHiZYfeoGhn7HHNQY0Up/qfzDPSvWo+ZaVQAqXcYLGTxaP70yywHOYABakJtBVKKkI1YPu83HFDVfw1PoYVaS5GAmEscq6nwoyC0Jm/pDirUtMoRibG2iiV6uYKQDvWrO9fBrGmavpmUT/ECtmcnrWj7V9zXzSi17HJhkq6gYc68iu6h8TBNJrIUE9Kgi07aWFRM9fbIM1ZVD/aEQ== ec2-user@cvl23server
-
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpuXUhr1Vzl1WljuFYSFIArU8wtlKWpkVLF4hCUb4dVWNEPU/FM1gkg4hPH+rTNPManRAJ8vxiCtMgLtvae2j1elO0edkM6BZReVDFMYo0fZVBbVR8fzvXRWD5ArXJeNI2uZ4fYTil3SoC3N0n+ySjqFriIkcBpxthKVcoOlK+yccOvCPGNWgqcSGFfMEKTR8P18ED83i7sOF2nzpH0RBo2/N7ry5Gzvfw859W7KScw/3uI7fzog6hW/P4niOQIZfG56enHHos0l7oymxeQRiYITqvf9Es1VatEfybk+tJhTVf1LcIqoM9v9bc0yd6QqST0+6ZiTJXCQCthmS0JVX1 hines@tun

roles/enable_sudo_group/tasks/main.yml

+---
+- name: set mode on /etc/sudoers.d
+  file: path=/etc/sudoers.d state=directory mode=755
+  become: true
+  become_user: root
+
+- name: template sudoers file
+  template: src=10-admin_group.j2 dest=/etc/sudoers.d/10-admin_group mode=440
+  become: true
+  become_user: root

roles/enable_sudo_group/templates/10-admin_group.j2

+%{{ sudo_group }} ALL=(ALL) ALL
+{% if nopasswd_user is defined %}
+{{ nopasswd_user }} ALL=(ALL) NOPASSWD:ALL
+{% endif %}

roles/enroot/README.md

+Install enroot on a ubuntu machine
+See https://github.com/NVIDIA/enroot
+
+Centos 7 requires a Kernel setting mod so is not supported at this time.
+
+enroot is not meant for installation across a cluster. Config files live only on
+installed machine, and container files need to be owned by the user using them.
+
+Usage
+- { roles: enroot, tags: [ enroot ] }
+
+
+Be aware, large files are created. You can/should set the following environment
+variables to a suitable file system.
+
+export ENROOT_RUNTIME_PATH=/mnt/enroot/runtime
+export ENROOT_CONFIG_PATH=/mnt/enroot/config
+export ENROOT_CACHE_PATH=/mnt/enroot/cache
+export ENROOT_DATA_PATH=/mnt/enroot/data
+export ENROOT_TEMP_PATH=/mnt/enroot/tmp

roles/enroot/tasks/main.yml

+---
+#see https://nvidia.github.io/libnvidia-container/
+#DIST=$(. /etc/os-release; echo $ID$VERSION_ID)
+#curl -s -L https://nvidia.github.io/libnvidia-container/gpgkey | \
+#  sudo apt-key add -
+#curl -s -L https://nvidia.github.io/libnvidia-container/$DIST/libnvidia-container.list | \
+#    sudo tee /etc/apt/sources.list.d/libnvidia-container.list
+#sudo apt-get update
+#
+- name: configure  Nivida repos
+  ansible.builtin.apt_key:
+    url:  https://nvidia.github.io/libnvidia-container/gpgkey
+    state: present
+  become: True
+  become_user: root
+  when: ansible_os_family == "Debian"
+
+- name: get DIST variable for repolist
+  shell: . /etc/os-release; echo $ID$VERSION_ID
+  register: DIST
+  when: ansible_os_family == "Debian"
+
+- name: Print out value of DIST
+  debug: msg={{ DIST.stdout }}
+  when: ansible_os_family == "Debian"
+
+#- name: Add specified repository into sources list
+#  ansible.builtin.apt_repository:
+#    #repo: "deb https://nvidia.github.io/libnvidia-container/{{ DIST.stdout }}/libnvidia-container.list"
+#    repo: "deb https://nvidia.github.io/libnvidia-container/ubuntu20.04 libnvidia-container"
+#    state: present
+
+- name: Add specified repository into sources list
+  shell: "curl -s -L https://nvidia.github.io/libnvidia-container/{{ DIST.stdout }}/libnvidia-container.list | sudo tee /etc/apt/sources.list.d/libnvidia-container.list"
+  become: True
+  become_user: root
+  when: ansible_os_family == "Debian"
+
+- name: Update apt-get repo and cache
+  apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
+  become: True
+  become_user: root
+  when: ansible_os_family == "Debian"
+
+ 
+- name: install  Nivida container tools
+  package:
+    state: present
+    name:
+      - libnvidia-container1
+      - libnvidia-container-tools
+  become: true
+  become_user: root
+  when: ansible_os_family == "Debian"
+
+- name: get architecture
+  shell: dpkg --print-architecture
+  register: ARCH
+  when: ansible_os_family == "Debian"
+
+
+
+- name: Print out value of ARCH
+  debug: msg={{ ARCH.stdout }}
+  when: ansible_os_family == "Debian"
+
+- name: install hardened enroot deb 1 of 2
+  apt:
+    deb: "https://github.com/NVIDIA/enroot/releases/download/v3.3.0/enroot-hardened_3.3.0-1_{{ ARCH.stdout }}.deb"
+  become: true
+  become_user: root
+  when: ansible_os_family == "Debian"
+
+- name: install hardened enroot deb  2 of 2
+  apt:
+    deb: "https://github.com/NVIDIA/enroot/releases/download/v3.3.0/enroot-hardened+caps_3.3.0-1_{{ ARCH.stdout }}.deb"
+  become: true
+  become_user: root
+  when: ansible_os_family == "Debian"
+

scripts/makehosts.py → roles/etcHosts/files/makehosts.py

 #!/usr/bin/python
 import sys
 import json
+import socket
 filename = sys.argv[1]
-domain = sys.argv[2]
+try:
+ domain = sys.argv[2]
+except IndexError:
+ domain = None
 f=open(filename,'r')
 s=f.read()
 d=json.loads(s)
@@ -12,7 +16,10 @@ hosts={}
 for group in d['groups'].keys():
     i=0
     for h in d['groups'][group]:
-        hosts[h] = ['%s.%s %s'%(h, domain, h)]
+      if not domain:
+        hosts[h] = [h]
+      else:
+        hosts[h] = ['%s.%s %s'%(h,domain,h)]
 
 for h in hosts.keys():
     if d['hostvars'].has_key(h):

roles/etcHosts/tasks/main.yml

-- name: get_groups_json
-  template: dest=/tmp/groups src=groups.j2
-  run_once: True
-  delegate_to: 127.0.0.1
-
-- name: make hosts data
-  command: ./scripts/makehosts.py /tmp/groups {{ domain }}
-  delegate_to: 127.0.0.1
-  run_once: True
-  register: hosts_data
-               
-- name: write hosts file
+- name: see if cloud.cfg exists
+  stat:
+    path: /etc/cloud/cloud.cfg
+  register: cloudcfg
+
+- name: set preserve hostname on CentOSVM
   lineinfile:
   args:
-    dest: /etc/hosts
-    line: "{{ item }}"
+    dest: /etc/cloud/cloud.cfg
+    line: "preserve_hostname: true"
     state: present
-  sudo: true
-  with_items: hosts_data.stdout_lines
+  become: true
+  when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "7" and cloudcfg.stat.islnk is defined
+
+- name: remove preserve_hostname_false on CentOS
+  lineinfile:
+  args:
+    dest: /etc/cloud/cloud.cfg
+    line: "preserve_hostname: false"
+    state: absent
+  become: true
+  when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "7"
+
+- name: get hostname by sysctl
+  shell: /sbin/sysctl kernel.hostname | /usr/bin/cut -f 3 -d " "
+  register: sysctl_hostname
+  check_mode: no
+  changed_when: False
+
+- name: set hostname by sysctl
+  shell: /sbin/sysctl kernel.hostname="{{ inventory_hostname }}"
+  become: true
+  when: not sysctl_hostname.stdout == inventory_hostname
+
+- name: set /etc/sysconfig/network on CentOS 6
+  lineinfile: dest=/etc/sysconfig/network line='HOSTNAME={{ inventory_hostname }}' regexp='^HOSTNAME'
+  become: true
+  when: ansible_distribution == "CentOS" and ansible_distribution_major_version == "6"
+
+- name: set /etc/sysctl.conf on Debian 8
+  lineinfile: dest=/etc/sysctl.conf line='kernel.domainname = {{ domain }}' regexp='^#kernel.domainname'
+  become: true
+  when: ansible_distribution == "Debian" and ansible_distribution_major_version == "8"
+
+- name: set /etc/hostname
+  template: src=hostname dest=/etc/hostname
+  become: true
+  become_user: root
+
+- name: install hosts file
+  copy: src=files/etcHosts dest=/etc/hosts owner=root mode=644
+  become: true
\ No newline at end of file

roles/etcHosts/templates/hostname

+{{ inventory_hostname }}

roles/extra_packages/README.md

+This role adds all the packages we think are useful but aren't clearly a dependency of some function.
+
+Before calling, you may want to  define the following lists:
+
+extra_packages  #list of yum packages. Or see code on how to it loads an  alternative file  if not defined
+exclude 	#list of packages to exclude
+
+
+Usage:
+  roles:
+  - { role: extra_packages, tags: [ other, extra_packages ] }

roles/extra_packages/tasks/main.yml

+---
+- name: load extra_packages from play
+  include_vars: "vars/extra_packages_{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml"
+  when: extra_packages is not defined
+
+- name: load vars from role
+  include_vars: "{{ ansible_distribution }}_{{ ansible_distribution_major_version }}.yml"
+  when: extra_packages is not defined
+
+- name: "Clear yum cache"
+  command: yum clean all
+  become: true
+  become_user: root
+  when: ansible_os_family == 'RedHat'
+  changed_when: false
+
+- name: "Clear yum pending transactions"
+  command: yum-complete-transaction --cleanup-only
+  become: true
+  become_user: root
+  register: yumCompleteTransactioncall
+  when: ansible_os_family == 'RedHat'
+  changed_when: '"No unfinished transactions left." not in yumCompleteTransactioncall.stdout'
+
+- name: "Install extra packages  Centos"
+  yum:
+    name: "{{ extra_packages }}"
+    exclude: "{{ excludes|join(',') }}"
+    update_cache: yes
+    state: present
+  become: true
+  become_user: root
+  when:
+   - '"CentOS" in ansible_distribution'
+  register: result
+
+- name: "Install extra packages Redhat"
+  yum:
+    name: "{{ extra_packages }}"
+    exclude: "{{ excludes|join(',') }}"
+    update_cache: yes
+    state: present
+    enablerepo: "org_monash_uni_EPEL_7_EPEL_7_-_x86_64"
+  become: true
+  become_user: root
+  when:
+   - '"RedHat" in ansible_distribution'
+   - '"DGX" in ansible_product_name'
+  register: result
+
+- name: "Install extra packages from epel only"
+  yum:
+    name: "{{ extra_packages_epel }}"
+    update_cache: yes
+    state: present
+    enablerepo: epel
+  become: true
+  become_user: root
+  when:
+   - '"CentOS" in ansible_distribution'
+
+
+- name: "Install extra packages"
+  apt: "name={{ extra_packages }} update_cache=yes state=present"
+  become: true
+  become_user: root
+  when: ansible_os_family == 'Debian'
+
+- name: "Install admin packages packages centos"
+  yum:
+    name:
+      - git
+      - centos-release-ansible-29.noarch
+      - centos-release-configmanagement
+    update_cache: yes
+    state: latest
+    enablerepo:
+      - extras
+  become: true
+  become_user: root
+  when:
+   - '"CentOS" in ansible_distribution'
+
+- name: "Install admin packages packages centos"
+  yum:
+    name:
+      - ansible
+    update_cache: yes
+    state: latest
+    enablerepo:
+      - centos-ansible-29
+  become: true
+  become_user: root
+  when:
+   - '"CentOS" in ansible_distribution'
+
+- name: "Install admin packages packages ubuntu"
+  package:
+    name:
+      - git
+      - ansible
+    state: latest
+  become: true
+  become_user: root
+  when:
+   - '"Ubuntu" in ansible_distribution'
+

roles/extra_packages/vars/CentOS_7.yml

+extra_packages:
+  - '@Development Tools'
+  - '@^Server with GUI'
+  - '@^GNOME Desktop'
+  - '@^KDE Plasma Workspaces'
+  - lzip
+  - screen
+  - mailx
+  - subversion
+  - mlocate
+  - finger
+  - python-devel
+  - python-pip
+  - python-wheel
+  - openldap-devel
+  - lapack
+  - blas
+  - gcc-c++
+  - psmisc
+  - iotop
+  #- @X Window System
+  - libX11-devel
+  - moreutils
+  - traceroute
+  - tmux
+  - git
+  - subversion
+  - numactl
+  - numactl-libs
+  - numactl-devel
+  #stuff for relion
+  - vim
+  - gedit
+  - m4
+  - flex
+  - flex-devel
+  - bison
+  - bison-devel
+  - zlib
+  - autogen
+  - rsync
+  - tcl-devel.x86_64
+  - tclx-devel.x86_64
+  - glibc-devel.i686
+  - zlib-devel
+  - pam-devel
+  - tk-devel
+  - texinfo
+  #- cpufrequtils-devel.x86_64
+  #- cpufrequtils.x86_64
+  - openssl
+  - openssl-devel
+  - gstreamer-devel.x86_64
+  - gstreamer-plugins-base-devel.x86_64
+  - libcurl-devel
+  - libXmu-devel.x86_64 # for matlab GUI
+  - xauth
+  - gtk+-devel
+  - gtk2-devel
+  - libidn-devel.x86_64
+  - libacl-devel.x86_64
+  - ncurses-devel.x86_64
+  - nasm.x86_64
+  - glibmm24-devel
+  - gtkmm24-devel
+  - gtkglext-devel
+  - gsl-devel
+  - mesa-libGL-devel
+  - mesa-libGLU-devel
+  - libpng
+  - texlive
+  - libjpeg-turbo-devel
+  - libjpeg-turbo
+  - libjpeg-turbo-utils
+  - libtiff
+  - libtiff-devel
+  - libtiff-tools
+  - levien-inconsolata-fonts.noarch
+  - java-1.7.0-openjdk
+  - java-1.7.0-openjdk-devel
+  - java-1.7.0-openjdk-javadoc
+  - java-1.8.0-openjdk
+  - java-1.8.0-openjdk-devel
+  - java-1.8.0-openjdk-javadoc
+  # stuff because bioinformatics need it for ubuntu
+  - ruby
+  - java-1.7.0-openjdk
+  - mysql-devel
+  - iptraf #for ip traffic monitoring
+  #- '"@GNOME Desktop"'
+  # lua stuff for lmod
+  - lua
+  - lua-filesystem
+  - lua-posix
+  - tcl
+  - rsync
+  - gcc
+  - lua-devel
+  # for physics c/o mark flegg
+  - cmake
+  - vtk-devel
+  - boost
+  - boost-devel
+  #- netcdf-devel
+  #- netcdf-cxx
+  - jsoncpp-devel.x86_64
+  - numpy
+  - vtk-python
+  - python-matplotlib
+  # jagmohan
+  - blas-static
+  - lapack-static
+  # James Venning (Water Channel)
+  - fftw-libs-single-3.3.3-8.el7
+  - fftw-libs-double-3.3.3-8.el7
+  - fftw-libs-long-3.3.3-8.el7
+  - fftw-libs-3.3.3-8.el7
+  - fftw2-2.1.5-26.el7
+  - fftw2-devel-2.1.5-26.el7
+  # ftp needed
+  - ftp
+  # gpm-libs for midnight commander
+  - gpm-libs
+  # jna for netcdf
+  - jna
+  - jna-javadoc
+  - jna-contrib
+  #underworld
+  - gl2ps
+  - gl2ps-devel
+  - SDL
+  - SDL-devel
+  - freeglut
+  - freeglut-devel
+  #
+  - qt-devel
+  # perf for Ehsan performance
+  - perf
+  - xorg-x11-server-Xvfb
+  # user request. login node only?
+  - nedit
+  #namd 2.9 needs 32 bit libraries
+  - libstdc++.i686
+  # eigen for yade
+  - eigen3-devel
+  - eigen3-doc.noarch
+  - sqlite
+  - vtk
+  - vtk-devel
+  - suitesparse
+  - suitesparse-devel
+  - mpfr
+  - mpfr-devel
+  - metis
+  - metis-devel
+  - metis64
+  - metis64-devel
+  - openblas
+  - openblas-devel
+  # for octopus
+  - libxc
+  - libxc-devel
+  # for atop
+  - atop
+  # for Andreas Ernst
+  - emacs
+  - zsh
+  # RT  #9173
+  - gnuplot
+  # for linuxbrew
+  - perl-CPAN
+
+
+
+

roles/extra_packages/vars/Ubuntu_14.yml

+# all packages to be installed on centos 7
+extra_packages:
+        - screen
+        - mailutils
+        - subversion
+        - finger
+        - python-dev
+        - python-pip
+        - python-wheel
+        - python-numpy
+        - python-matplotlib
+        - liblapack-dev
+        - liblapack-doc
+        #python-dev libldap2-dev libsasl2-dev libssl-dev
+        - libsasl2-dev
+        - libldap2-dev
+        - libsasl2-dev
+        - libssl-dev
+        - libblas-dev
+        - libblas-doc
+        - g++
+        - psmisc
+        - iotop
+        - xorg
+        - openbox
+        - libx11-dev
+        - moreutils
+        - traceroute
+        - tmux
+        - git
+        - subversion
+        - numactl
+        - libnuma1
+        - libnuma-dev
+        - libncurses5-dev
+        - ncurses-dev
+        - unzip
+        - libpng12-dev
+        - texlive
+        - openjdk-7-jdk
+        - libjpeg62
+        - libjpeg62-dev
+        #- libjpeg-turbo8-dev
+        #- libjpeg8-dev #for tiff
+        #- libtiff5
+        #- libtiff5-dev
+        #- libtiff-tools
+        - texlive-fonts-extra
+        # stuff because bioinformatics need it for ubuntu
+        - ruby
+        - openjdk-7-jre
+        - libmysqlclient-dev
+        - iptraf
+        - iptraf-ng #for ip traffic monitoring
+#        - gnome-shell
+#        - ubuntu-gnome-desktop #gnome desktop
+        - vim
+        #lua stuff for lmod
+        - lua5.2
+        - lua5.2
+        - lua-filesystem
+        - lua-bitop
+        - lua-posix
+        - liblua5.2-0
+        - liblua5.2-dev
+        - tcl
+        # for bioinformatics
+        - ant
+        - golang
+        - ipython
+        - htop
+        # yade for LOUIS KING * civil engineering
+        - yade
+        - zsh
+        # adele request (bioinformatics)
+        # linuxbrew
+        - build-essential
+        - curl
+        - git
+        - python-setuptools
+        - ruby
+        # adele
+        - ncbi-blast+
+        - bedtools
+        - cd-hit
+        - mcl
+        - parallel
+        - cpanminus
+        - prank
+        - mafft
+        - fasttree
+        - pandoc
+        # chris request utility packages
+        - liblzma-dev
+        - libpcre3-dev
+        - libcurl4-openssl-dev

roles/extra_rpms/vars/main.yml → roles/extra_packages/vars/main.yml

@@ -8,6 +8,7 @@ pkgs:
  - bitmap-fonts-compat
  - bitmap-lucida-typewriter-fonts
  - bitmap-miscfixed-fonts
+ - blas
  - compiz-gnome
  - db4-cxx
  - db4-devel
@@ -15,6 +16,8 @@ pkgs:
  - enchant
  - eog
  - evince
+ - finger
+ - fftw
  - file-roller
  - firefox
  - firstboot
@@ -92,6 +95,7 @@ pkgs:
  - inotify-tools
  - java-1.7.0-openjdk
  - jline
+ - lapack
  - leafpad
  - libblkid
  - libdrm
@@ -121,6 +125,7 @@ pkgs:
  - libXpm
  - libXt
  - libXtst
+ - mailx
  - man
  - mod_ssl
  - mysql-server
@@ -145,6 +150,8 @@ pkgs:
  - perl-devel
  - perl-ExtUtils-MakeMaker
  - perl-ExtUtils-ParseXS
+ - perl-HTML-Parser
+ - perl-HTML-Tagset
  - perl-Test-Harness
  - perl-Time-HiRes
  - pexpect
@@ -159,6 +166,8 @@ pkgs:
  - plymouth-system-theme
  - polkit-gnome
  - postgresql
+ - postgresql-contrib
+ - postgresql-devel
  - postgresql-libs
  - postgresql-server
  - PyGreSQL
@@ -166,6 +175,7 @@ pkgs:
  - python-babel
  - python-dateutil
  - python-devel
+ - python-ldap
  - python-matplotlib
  - python-nose
  - python-paramiko
@@ -179,10 +189,13 @@ pkgs:
  - qt-sqlite
  - qt-x11
  - rhino
+ - rsync
+ - samba-client
  - scipy
  - spice-vdagent
  - suitesparse
  - system-gnome-theme
+ - tcl
  - tcsh
  - Terminal
  - texlive-texmf-errata-fonts
@@ -195,6 +208,10 @@ pkgs:
  - unzip
  - util-linux-ng
  - uuid
+ - vim-X11
+ - vim-common
+ - vim-enhanced
+ - vim-minimal
  - wacomexpresskeys
  - wdaemon
  - wxBase
@@ -235,8 +252,3 @@ pkgs:
  - xvattr
  - yum-utils
  - zip
- - perl-HTML-Parser
- - perl-HTML-Tagset 
- - postgresql-contrib
- - postgresql-devel
- - environment-modules

roles/extra_rpms/tasks/main.yml

----
-
-- name: "update cache"
-  shell: yum update -y
-  sudo: true
-  when: ansible_os_family == 'RedHat'
-
-- name: "Install extra packages"
-  yum: "name={{ item }} state=latest"
-  with_items:
-    pkgs
-  sudo: true
-  when: ansible_os_family == 'RedHat'
-

roles/fail2ban/handlers/main.yml

+---
+- name: restart fail2ban
+  systemd:
+    name: fail2ban
+    enabled: yes
+    state: restarted
+  become: true
+  become_user: root

roles/fail2ban/tasks/main.yml

+---
+- name: Install fail2ban on Red Hat system
+  yum:
+    name:
+    - fail2ban-server
+    - fail2ban-sendmail
+    state: present
+  become: true
+  become_user: root
+  when: ansible_os_family == "RedHat"
+
+- name: Copy jail.conf.j2 to /etc/fail2ban/jail.conf
+  template:
+    src: jail.conf.j2
+    dest: /etc/fail2ban/jail.conf
+    backup: yes
+    mode: 0644
+    owner: root
+    group: root
+  become: true
+  become_user: root
+  notify:
+    - restart fail2ban
+
+- name: Enable fail2ban service
+  systemd:
+    name: fail2ban
+    enabled: yes
+    state: started
+  become: true
+  become_user: root

roles/fail2ban/templates/jail.conf.j2

+#
+# WARNING: heavily refactored in 0.9.0 release.  Please review and
+#          customize settings for your setup.
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in jail.local file,
+#           or separate .conf files under jail.d/ directory, e.g.:
+#
+# HOW TO ACTIVATE JAILS:
+#
+# YOU SHOULD NOT MODIFY THIS FILE.
+#
+# It will probably be overwritten or improved in a distribution update.
+#
+# Provide customizations in a jail.local file or a jail.d/customisation.local.
+# For example to change the default bantime for all jails and to enable the
+# ssh-iptables jail the following (uncommented) would appear in the .local file.
+# See man 5 jail.conf for details.
+#
+# [DEFAULT]
+# bantime = 3600
+#
+# [sshd]
+# enabled = true
+#
+# See jail.conf(5) man page for more information
+
+
+
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
+
+
+[INCLUDES]
+
+#before = paths-distro.conf
+before = paths-fedora.conf
+
+# The DEFAULT allows a global definition of the options. They can be overridden
+# in each jail afterwards.
+
+[DEFAULT]
+
+#
+# MISCELLANEOUS OPTIONS
+#
+
+# "ignoreip" can be an IP address, a CIDR mask or a DNS host. Fail2ban will not
+# ban a host which matches an address in this list. Several addresses can be
+# defined using space (and/or comma) separator.
+#ignoreip = 127.0.0.1/8
+ignoreip = {{ fail2ban_whitelist_all }}
+
+# External command that will take an tagged arguments to ignore, e.g. <ip>,
+# and return true if the IP is to be ignored. False otherwise.
+#
+# ignorecommand = /path/to/command <ip>
+ignorecommand =
+
+# "bantime" is the number of seconds that a host is banned.
+bantime  = 600
+
+# A host is banned if it has generated "maxretry" during the last "findtime"
+# seconds.
+findtime  = 600
+
+# "maxretry" is the number of failures before a host get banned.
+maxretry = 5
+
+# "backend" specifies the backend used to get files modification.
+# Available options are "pyinotify", "gamin", "polling", "systemd" and "auto".
+# This option can be overridden in each jail as well.
+#
+# pyinotify: requires pyinotify (a file alteration monitor) to be installed.
+#              If pyinotify is not installed, Fail2ban will use auto.
+# gamin:     requires Gamin (a file alteration monitor) to be installed.
+#              If Gamin is not installed, Fail2ban will use auto.
+# polling:   uses a polling algorithm which does not require external libraries.
+# systemd:   uses systemd python library to access the systemd journal.
+#              Specifying "logpath" is not valid for this backend.
+#              See "journalmatch" in the jails associated filter config
+# auto:      will try to use the following backends, in order:
+#              pyinotify, gamin, polling.
+#
+# Note: if systemd backend is chosen as the default but you enable a jail
+#       for which logs are present only in its own log files, specify some other
+#       backend for that jail (e.g. polling) and provide empty value for
+#       journalmatch. See https://github.com/fail2ban/fail2ban/issues/959#issuecomment-74901200
+backend = auto
+
+# "usedns" specifies if jails should trust hostnames in logs,
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
+#
+# yes:   if a hostname is encountered, a DNS lookup will be performed.
+# warn:  if a hostname is encountered, a DNS lookup will be performed,
+#        but it will be logged as a warning.
+# no:    if a hostname is encountered, will not be used for banning,
+#        but it will be logged as info.
+# raw:   use raw value (no hostname), allow use it for no-host filters/actions (example user)
+usedns = warn
+
+# "logencoding" specifies the encoding of the log files handled by the jail
+#   This is used to decode the lines from the log file.
+#   Typical examples:  "ascii", "utf-8"
+#
+#   auto:   will use the system locale setting
+logencoding = auto
+
+# "enabled" enables the jails.
+#  By default all jails are disabled, and it should stay this way.
+#  Enable only relevant to your setup jails in your .local or jail.d/*.conf
+#
+# true:  jail will be enabled and log files will get monitored for changes
+# false: jail is not enabled
+enabled = false
+
+
+# "filter" defines the filter to use by the jail.
+#  By default jails have names matching their filter name
+#
+filter = %(__name__)s
+
+
+#
+# ACTIONS
+#
+
+# Some options used for actions
+
+# Destination email address used solely for the interpolations in
+# jail.{conf,local,d/*} configuration files.
+destemail = root@localhost
+
+# Sender email address used solely for some actions
+sender = root@localhost
+
+# E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA for the
+# mailing. Change mta configuration parameter to mail if you want to
+# revert to conventional 'mail'.
+mta = sendmail
+
+# Default protocol
+protocol = tcp
+
+# Specify chain where jumps would need to be added in iptables-* actions
+chain = INPUT
+
+# Ports to be banned
+# Usually should be overridden in a particular jail
+port = 0:65535
+
+# Format of user-agent https://tools.ietf.org/html/rfc7231#section-5.5.3
+fail2ban_agent = Fail2Ban/%(fail2ban_version)s
+
+#
+# Action shortcuts. To be used to define action parameter
+
+# Default banning action (e.g. iptables, iptables-new,
+# iptables-multiport, shorewall, etc) It is used to define
+# action_* variables. Can be overridden globally or per
+# section within jail.local file
+banaction = iptables-multiport
+banaction_allports = iptables-allports
+
+# The simplest action to take: ban only
+action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report to the destemail.
+action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+            %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+# ban & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# See the IMPORTANT note in action.d/xarf-login-attack for when to use this action
+#
+# ban & send a xarf e-mail to abuse contact of IP address and include relevant log lines
+# to the destemail.
+action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
+
+# ban IP on CloudFlare & send an e-mail with whois report and relevant log lines
+# to the destemail.
+action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+                %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# Report block via blocklist.de fail2ban reporting service API
+# 
+# See the IMPORTANT note in action.d/blocklist_de.conf for when to
+# use this action. Create a file jail.d/blocklist_de.local containing
+# [Init]
+# blocklist_de_apikey = {api key from registration]
+#
+action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
+
+# Report ban via badips.com, and use as blacklist
+#
+# See BadIPsAction docstring in config/action.d/badips.py for
+# documentation for this action.
+#
+# NOTE: This action relies on banaction being present on start and therefore
+# should be last action defined for a jail.
+#
+action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
+#
+# Report ban via badips.com (uses action.d/badips.conf for reporting only)
+#
+action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]
+
+# Choose default action.  To change, just override value of 'action' with the
+# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
+# globally (section [DEFAULT]) or per specific section
+action = %(action_)s
+
+
+#
+# JAILS
+#
+
+#
+# SSH servers
+#
+
+[sshd]
+
+# To use more aggressive sshd filter (inclusive sshd-ddos failregex):
+#filter = sshd-aggressive
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+
+
+[sshd-ddos]
+# This jail corresponds to the standard configuration in Fail2ban.
+# The mail-whois action send a notification e-mail with a whois request
+# in the body.
+port    = ssh
+logpath = %(sshd_log)s
+backend = %(sshd_backend)s
+
+
+[dropbear]
+
+port     = ssh
+logpath  = %(dropbear_log)s
+backend  = %(dropbear_backend)s
+
+
+[selinux-ssh]
+
+port     = ssh
+logpath  = %(auditd_log)s
+
+
+#
+# HTTP servers
+#
+
+[apache-auth]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-badbots]
+# Ban hosts which agent identifies spammer robots crawling the web
+# for email addresses. The mail outputs are buffered.
+port     = http,https
+logpath  = %(apache_access_log)s
+bantime  = 172800
+maxretry = 1
+
+
+[apache-noscript]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+
+
+[apache-overflows]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-nohome]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-botsearch]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-fakegooglebot]
+
+port     = http,https
+logpath  = %(apache_access_log)s
+maxretry = 1
+ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>
+
+
+[apache-modsecurity]
+
+port     = http,https
+logpath  = %(apache_error_log)s
+maxretry = 2
+
+
+[apache-shellshock]
+
+port    = http,https
+logpath = %(apache_error_log)s
+maxretry = 1
+
+
+[openhab-auth]
+
+filter = openhab
+action = iptables-allports[name=NoAuthFailures]
+logpath = /opt/openhab/logs/request.log
+
+
+[nginx-http-auth]
+
+port    = http,https
+logpath = %(nginx_error_log)s
+
+# To use 'nginx-limit-req' jail you should have `ngx_http_limit_req_module` 
+# and define `limit_req` and `limit_req_zone` as described in nginx documentation
+# http://nginx.org/en/docs/http/ngx_http_limit_req_module.html
+# or for example see in 'config/filter.d/nginx-limit-req.conf'
+[nginx-limit-req]
+port    = http,https
+logpath = %(nginx_error_log)s
+
+[nginx-botsearch]
+
+port     = http,https
+logpath  = %(nginx_error_log)s
+maxretry = 2
+
+
+# Ban attackers that try to use PHP's URL-fopen() functionality
+# through GET/POST variables. - Experimental, with more than a year
+# of usage in production environments.
+
+[php-url-fopen]
+
+port    = http,https
+logpath = %(nginx_access_log)s
+          %(apache_access_log)s
+
+
+[suhosin]
+
+port    = http,https
+logpath = %(suhosin_log)s
+
+
+[lighttpd-auth]
+# Same as above for Apache's mod_auth
+# It catches wrong authentifications
+port    = http,https
+logpath = %(lighttpd_error_log)s
+
+
+#
+# Webmail and groupware servers
+#
+
+[roundcube-auth]
+
+port     = http,https
+logpath  = %(roundcube_errors_log)s
+
+
+[openwebmail]
+
+port     = http,https
+logpath  = /var/log/openwebmail.log
+
+
+[horde]
+
+port     = http,https
+logpath  = /var/log/horde/horde.log
+
+
+[groupoffice]
+
+port     = http,https
+logpath  = /home/groupoffice/log/info.log
+
+
+[sogo-auth]
+# Monitor SOGo groupware server
+# without proxy this would be:
+# port    = 20000
+port     = http,https
+logpath  = /var/log/sogo/sogo.log
+
+
+[tine20]
+
+logpath  = /var/log/tine20/tine20.log
+port     = http,https
+
+
+#
+# Web Applications
+#
+#
+
+[drupal-auth]
+
+port     = http,https
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+[guacamole]
+
+port     = http,https
+logpath  = /var/log/tomcat*/catalina.out
+
+[monit]
+#Ban clients brute-forcing the monit gui login
+port = 2812
+logpath  = /var/log/monit
+
+
+[webmin-auth]
+
+port    = 10000
+logpath = %(syslog_authpriv)s
+backend = %(syslog_backend)s
+
+
+[froxlor-auth]
+
+port    = http,https
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+#
+# HTTP Proxy servers
+#
+#
+
+[squid]
+
+port     =  80,443,3128,8080
+logpath = /var/log/squid/access.log
+
+
+[3proxy]
+
+port    = 3128
+logpath = /var/log/3proxy.log
+
+
+#
+# FTP servers
+#
+
+
+[proftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(proftpd_log)s
+backend  = %(proftpd_backend)s
+
+
+[pure-ftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(pureftpd_log)s
+backend  = %(pureftpd_backend)s
+
+
+[gssftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(syslog_daemon)s
+backend  = %(syslog_backend)s
+
+
+[wuftpd]
+
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(wuftpd_log)s
+backend  = %(wuftpd_backend)s
+
+
+[vsftpd]
+# or overwrite it in jails.local to be
+# logpath = %(syslog_authpriv)s
+# if you want to rely on PAM failed login attempts
+# vsftpd's failregex should match both of those formats
+port     = ftp,ftp-data,ftps,ftps-data
+logpath  = %(vsftpd_log)s
+
+
+#
+# Mail servers
+#
+
+# ASSP SMTP Proxy Jail
+[assp]
+
+port     = smtp,465,submission
+logpath  = /root/path/to/assp/logs/maillog.txt
+
+
+[courier-smtp]
+
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix]
+
+port     = smtp,465,submission
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+
+
+[postfix-rbl]
+
+port     = smtp,465,submission
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+maxretry = 1
+
+
+[sendmail-auth]
+
+port    = submission,465,smtp
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[sendmail-reject]
+
+port     = smtp,465,submission
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[qmail-rbl]
+
+filter  = qmail
+port    = smtp,465,submission
+logpath = /service/qmail/log/main/current
+
+
+# dovecot defaults to logging to the mail syslog facility
+# but can be set by syslog_facility in the dovecot configuration.
+[dovecot]
+
+port    = pop3,pop3s,imap,imaps,submission,465,sieve
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[sieve]
+
+port   = smtp,465,submission
+logpath = %(dovecot_log)s
+backend = %(dovecot_backend)s
+
+
+[solid-pop3d]
+
+port    = pop3,pop3s
+logpath = %(solidpop3d_log)s
+
+
+[exim]
+
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[exim-spam]
+
+port   = smtp,465,submission
+logpath = %(exim_main_log)s
+
+
+[kerio]
+
+port    = imap,smtp,imaps,465
+logpath = /opt/kerio/mailserver/store/logs/security.log
+
+
+#
+# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
+# all relevant ports get banned
+#
+
+[courier-auth]
+
+port     = smtp,465,submission,imap3,imaps,pop3,pop3s
+logpath  = %(syslog_mail)s
+backend  = %(syslog_backend)s
+
+
+[postfix-sasl]
+
+port     = smtp,465,submission,imap3,imaps,pop3,pop3s
+# You might consider monitoring /var/log/mail.warn instead if you are
+# running postfix since it would provide the same log lines at the
+# "warn" level but overall at the smaller filesize.
+logpath  = %(postfix_log)s
+backend  = %(postfix_backend)s
+
+
+[perdition]
+
+port   = imap3,imaps,pop3,pop3s
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[squirrelmail]
+
+port = smtp,465,submission,imap2,imap3,imaps,pop3,pop3s,http,https,socks
+logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log
+
+
+[cyrus-imap]
+
+port   = imap3,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+[uwimap-auth]
+
+port   = imap3,imaps
+logpath = %(syslog_mail)s
+backend = %(syslog_backend)s
+
+
+#
+#
+# DNS servers
+#
+
+
+# !!! WARNING !!!
+#   Since UDP is connection-less protocol, spoofing of IP and imitation
+#   of illegal actions is way too simple.  Thus enabling of this filter
+#   might provide an easy way for implementing a DoS against a chosen
+#   victim. See
+#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
+#   Please DO NOT USE this jail unless you know what you are doing.
+#
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks UDP traffic for DNS requests.
+# [named-refused-udp]
+#
+# filter   = named-refused
+# port     = domain,953
+# protocol = udp
+# logpath  = /var/log/named/security.log
+
+# IMPORTANT: see filter.d/named-refused for instructions to enable logging
+# This jail blocks TCP traffic for DNS requests.
+
+[named-refused]
+
+port     = domain,953
+logpath  = /var/log/named/security.log
+
+
+[nsd]
+
+port     = 53
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+logpath = /var/log/nsd.log
+
+
+#
+# Miscellaneous
+#
+
+[asterisk]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/asterisk/messages
+maxretry = 10
+
+
+[freeswitch]
+
+port     = 5060,5061
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+           %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"]
+logpath  = /var/log/freeswitch.log
+maxretry = 10
+
+
+# To log wrong MySQL access attempts add to /etc/my.cnf in [mysqld] or
+# equivalent section:
+# log-warning = 2
+#
+# for syslog (daemon facility)
+# [mysqld_safe]
+# syslog
+#
+# for own logfile
+# [mysqld]
+# log-error=/var/log/mysqld.log
+[mysqld-auth]
+
+port     = 3306
+logpath  = %(mysql_log)s
+backend  = %(mysql_backend)s
+
+
+# Log wrong MongoDB auth (for details see filter 'filter.d/mongodb-auth.conf')
+[mongodb-auth]
+# change port when running with "--shardsvr" or "--configsvr" runtime operation
+port     = 27017
+logpath  = /var/log/mongodb/mongodb.log
+
+
+# Jail for more extended banning of persistent abusers
+# !!! WARNINGS !!!
+# 1. Make sure that your loglevel specified in fail2ban.conf/.local
+#    is not at DEBUG level -- which might then cause fail2ban to fall into
+#    an infinite loop constantly feeding itself with non-informative lines
+# 2. Increase dbpurgeage defined in fail2ban.conf to e.g. 648000 (7.5 days)
+#    to maintain entries for failed logins for sufficient amount of time
+[recidive]
+
+logpath  = /var/log/fail2ban.log
+banaction = %(banaction_allports)s
+bantime  = 604800  ; 1 week
+findtime = 86400   ; 1 day
+
+
+# Generic filter for PAM. Has to be used with action which bans all
+# ports such as iptables-allports, shorewall
+
+[pam-generic]
+# pam-generic filter can be customized to monitor specific subset of 'tty's
+banaction = %(banaction_allports)s
+logpath  = %(syslog_authpriv)s
+backend  = %(syslog_backend)s
+
+
+[xinetd-fail]
+
+banaction = iptables-multiport-log
+logpath   = %(syslog_daemon)s
+backend   = %(syslog_backend)s
+maxretry  = 2
+
+
+# stunnel - need to set port for this
+[stunnel]
+
+logpath = /var/log/stunnel4/stunnel.log
+
+
+[ejabberd-auth]
+
+port    = 5222
+logpath = /var/log/ejabberd/ejabberd.log
+
+
+[counter-strike]
+
+logpath = /opt/cstrike/logs/L[0-9]*.log
+# Firewall: http://www.cstrike-planet.com/faq/6
+tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039
+udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015
+action  = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp]
+
+# consider low maxretry and a long bantime
+# nobody except your own Nagios server should ever probe nrpe
+[nagios]
+
+logpath  = %(syslog_daemon)s     ; nrpe.cfg may define a different log_facility
+backend  = %(syslog_backend)s
+maxretry = 1
+
+
+[oracleims]
+# see "oracleims" filter file for configuration requirement for Oracle IMS v6 and above
+logpath = /opt/sun/comms/messaging64/log/mail.log_current
+banaction = %(banaction_allports)s
+
+[directadmin]
+logpath = /var/log/directadmin/login.log
+port = 2222
+
+[portsentry]
+logpath  = /var/lib/portsentry/portsentry.history
+maxretry = 1
+
+[pass2allow-ftp]
+# this pass2allow example allows FTP traffic after successful HTTP authentication
+port         = ftp,ftp-data,ftps,ftps-data
+# knocking_url variable must be overridden to some secret value in jail.local
+knocking_url = /knocking/
+filter       = apache-pass[knocking_url="%(knocking_url)s"]
+# access log of the website with HTTP auth
+logpath      = %(apache_access_log)s
+blocktype    = RETURN
+returntype   = DROP
+bantime      = 3600
+maxretry     = 1
+findtime     = 1
+
+
+[murmur]
+# AKA mumble-server
+port     = 64738
+action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp]
+           %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp]
+logpath  = /var/log/mumble-server/mumble-server.log
+
+
+[screensharingd]
+# For Mac OS Screen Sharing Service (VNC)
+logpath  = /var/log/system.log
+logencoding = utf-8
+
+[haproxy-http-auth]
+# HAProxy by default doesn't log to file you'll need to set it up to forward
+# logs to a syslog server which would then write them to disk.
+# See "haproxy-http-auth" filter for a brief cautionary note when setting
+# maxretry and findtime.
+logpath  = /var/log/haproxy.log
+
+[slapd]
+port    = ldap,ldaps
+filter  = slapd
+logpath = /var/log/slapd.log
+
+[domino-smtp]
+port    = smtp,ssmtp
+filter  = domino-smtp
+logpath = /home/domino01/data/IBM_TECHNICAL_SUPPORT/console.log

roles/fastest_mirror/tasks/main.yml

 - name: "Clear yum cache"
   command: yum clean all
-  sudo: true
+  become: true
   when: ansible_os_family == 'RedHat'
 
+- name: remove the bad repo on centos7 images
+  file: path=/etc/yum.repos.d/rdo-release.repo state=absent
+  become: true
+
 - name: "Make yum cache"
   command: yum makecache
-  sudo: true
+  become: true
+  when: ansible_os_family == 'RedHat'
+
+# For some reason ed went missing from the NeCTAR official CentOS 7 image
+# This meant that fail2ban could ban you, but could never unban you
+- name: "make sure ed is installed"
+  yum: name=ed state=present
+  become: true
   when: ansible_os_family == 'RedHat'