various fixed

playbooks/fail2ban-ingress/fail2ban-ingress.yml

@@ -8,6 +8,11 @@
         name: fail2ban
         state: present
 
+    - name: Install sudo
+      ansible.builtin.apt:
+        name: sudo
+        state: present
+
     - name: Create user
       ansible.builtin.user:
         name: fail2forward
@@ -38,6 +43,16 @@
         group: root
         mode: '0755'
 
+    - name: Allow fail2forward to run fail2ban-client
+      ansible.builtin.copy:
+        content: |
+          fail2forward ALL=(root) NOPASSWD: /usr/bin/fail2ban-client set sshd banip *, /usr/bin/fail2ban-client set sshd unbanip *
+        dest: /etc/sudoers.d/fail2forward
+        owner: root
+        group: root
+        mode: '0440'
+        validate: /usr/sbin/visudo -cf %s
+
     - name: Copy jail.local
       ansible.builtin.template:
         src: jail.local.j2

playbooks/fail2ban-ingress/fail2forward.j2

@@ -4,12 +4,12 @@ case "$SSH_ORIGINAL_COMMAND" in
   "ban "*)
     ip="${SSH_ORIGINAL_COMMAND#ban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd banip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd banip "$ip"
     ;;
   "unban "*)
     ip="${SSH_ORIGINAL_COMMAND#unban }"
     [[ "$ip" =~ ^[0-9.]+$|^[0-9a-fA-F:]+$ ]] || { echo "bad ip"; exit 1; }
-    exec fail2ban-client set sshd unbanip "$ip"
+    exec sudo /usr/bin/fail2ban-client set sshd unbanip "$ip"
     ;;
   *)
     echo "denied" >&2; exit 1