Install and configure fail2ban for ssh and Apache protection on Ubuntu

ubuntu-fail2ban.yml

---
# Install and configure fail2ban for ssh and Apache protection
- name: Install fail2ban
  apt: pkg=fail2ban
    state=present
    update_cache=yes

- name: Create local fail2ban config
  command: cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
    creates=/etc/fail2ban/jail.local
  notify: restart fail2ban

- name: Set fail2ban bantime to 1 hour
  # Use lineinfile because ConfigParser rejects section=default
  lineinfile: dest=/etc/fail2ban/jail.local
      regexp="^bantime = "
      state=present
      line="bantime = 3600"

- name: Set fail2ban destemail
  # Use lineinfile because ConfigParser rejects section=default
  lineinfile: dest=/etc/fail2ban/jail.local
      regexp="^destemail = "
      state=present
      line="destemail = $fail2ban_destemail"
  when_string: $fail2ban_destemail != ""
  notify: restart fail2ban

- name: Enable fail2ban filters
  ini_file: dest=/etc/fail2ban/jail.local
    section=$item
    option=enabled
    value=true
  with_items:
  - ssh
  - ssh-ddos
  - pam-generic
  - apache
  - apache-noscript
  - apache-overflows
  notify: restart fail2ban