CentOS 8 doesn't have a default package for fail2ban
geerlingguy opened this issue · comments
On CentOS 8:
TASK [geerlingguy.security : Install fail2ban.] ********************************
fatal: [kube2]: FAILED! => {"changed": false, "failures": ["No package fail2ban available."], "msg": "Failed to install some of the specified packages", "rc": 1, "results": []}
fatal: [kube1]: FAILED! => {"changed": false, "failures": ["No package fail2ban available."], "msg": "Failed to install some of the specified packages", "rc": 1, "results": []}
fatal: [kube3]: FAILED! => {"changed": false, "failures": ["No package fail2ban available."], "msg": "Failed to install some of the specified packages", "rc": 1, "results": []}
Welp. I should read my own role's directions. As long as you have EPEL installed, it works :D
Shouldn't this role install EPEL in case you have fail2ban to true and the OS is RHEL ?
@ppadial - Note that EPEL is listed as a dependency in the readme: https://github.com/geerlingguy/ansible-role-security#requirements — I typically use my epel role to install it.
@geerlingguy thanks for the answer, I was asking more from your experience, since it could be possible to add the EPEL (your role) dependency in the meta dependencies. What do you think? is better specify as dependency in meta so the role is "self-contained" and don't depend on previous stuff to be executed? or better specifying in the documentation that EPEL has to be present.
@ppadial - I typically avoid doing that unless absolutely necessary, because that would require that role to always run even when someone wants to install EPEL some other way (or if it's already installed in their base image)—additionally, anyone using a distro that's not RHEL/CentOS would have to download an extra role that would do nothing to help them (and might even cause their playbook to fail).
that makes perfect sense. Even if we add some lines to the role to check if epel is already installed (in case of REHL based distro) what you mention is true, epel modifies so much more than just a lib or package, is an entire package repository that will alter also yum/dnf commands (in the sense of where to get packages from).
Thanks for clarification