Add built-in fail2ban filters

[swalkinshaw]

Trellis supported default fail2ban services previously but they were restricted to filters built into fail2ban itself (like sshd).

This adds filters defined by Trellis as well now by automatically creating the filter configuration files from templates.

Importantly, these filters will be disabled by default. Any time a new filter is added, it will also be added to fail2ban_services_custom with enabled set to false.

This achieves a few goals:

1. makes it very easy to enable the built-in filters, which
2. brings more awareness to them by adding them to group_vars/all/security.yml
3. hopefully encourages more fail2ban filters to be created and used

There's two initial filters:

• wp-login
• xmlrpc

Which are both designed to prevent common DDoS attack vectors.

[swalkinshaw]

@tangrufus I think we "recommend" (or at least link to) https://github.com/ItinerisLtd/trellis-disable-xml-rpc but the fail2ban based solution should be better since it will prevent it at the iptables level so requests don't even reach Nginx.

Any thoughts?

[tangrufus]

the fail2ban based solution should be better since it will prevent it at the iptables level so requests don't even reach Nginx.

Agree.

I think we "recommend" (or at least link to) ItinerisLtd/trellis-disable-xml-rpc

Agree. They block at different levels. It should be okay to have both enabled at the same time.

---

We should update https://docs.roots.io, especially:

1. how to determine whether an IP is being banned
2. how to use fail2ban_ignoreip
3. how to unban IPs
4. warn about legitimate use cases of xmlrpc (e.g: jetpack)
5. warn about wrong IPs, Nginx might log proxy IPs / VPN IPs (e.g: Cloudflare, workplace VPN, load balancer)
6. how to adjust the rate limit

---

Question: When an IP is banned because of one of the fail2ban services (e.g: wordpress-xmlrpc), does fail2ban ban all its access (to different URLs) via http and https?

If yes, we should warn the users.

[tangrufus]

Looks good to me

[swalkinshaw]

Question: When an IP is banned because of one of the fail2ban services (e.g: wordpress-xmlrpc), does fail2ban ban all its access (to different URLs) via http and https?

I believe so since the ban is done at the iptables level which doesn't know about URLs. So the initial detection is URL based, but the ban isn't.