+
+
|Repo Name| version | Build
Status|
|---|---|---|---|
-|cd_fail2ban| 0.0.0.4 | cd_fail2ban| 0.0.0.5 | {Build
Status/]|
|Repo Name| version | Build
Status|
|---|---|---|---|
-|cd_fail2ban| 0.0.0.4 | cd_fail2ban| 0.0.0.5 | {Build
Status/]|
# File 'manifests/main/files.pp', line 23
@@ -213,6 +245,38 @@ class cd_fail2ban::main::files (
notify => Service[$fn_service],
}
+ # manage jail.conf
+
+ file { $fn_jail_conf_file:
+ ensure => present,
+ path => $fn_jail_conf_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_jail_conf_erb),
+ notify => Service[$fn_service],
+ }
+
+ # manage jail.local
+
+ file { $fn_jail_local_file:
+ ensure => present,
+ path => $fn_jail_local_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_jail_local_erb),
+ notify => Service[$fn_service],
+ }
+
}
}
age in seconds at which bans should be purged from the database.
+can be an IP address, a CIDR mask or a DNS host. +Fail2ban will not ban a +host which matches an address in this list. Several +addresses can be +defined using space (and/or comma) separator.
+External command that will take an +tagged arguments to ignore, e.g. +<ip>,and return true if the IP is to be +ignored. False otherwise.
+number of seconds that a host is banned.
+A host is banned if it has generated “maxretry” +during the last +"findtime" seconds.
+number of failures before a host get banned.
+specifies the backend used to get files +modification. options are +"pyinotify", "gamin", "polling", +"systemd" and +"auto". +pyinotify: requires pyinotify (a +file alteration monitor) to be installed. + If pyinotify is not installed, +Fail2ban will use auto. +gamin: requires Gamin (a file alteration monitor) +to be installed. + If Gamin is not installed, Fail2ban will use +auto. +polling: uses a polling algorithm which does not require external +libraries. +systemd: uses systemd python library to access the systemd +journal. + Specifying "logpath" is not valid for this backend. + +See "journalmatch" in the jails associated filter config +auto: +will try to use the following backends, in order: + pyinotify, gamin, +polling.
+specifies if jails should trust hostnames in logs, +warn when DNS lookups +are performed, or ignore all hostnames in logs +yes: if a hostname is +encountered, a DNS lookup will be performed. +warn: if a hostname is +encountered, a DNS lookup will be performed, + but it will be logged as a +warning. +no: if a hostname is encountered, will not be used for banning, + +but it will be logged as info. +raw: use raw value (no hostname), allow use +it for no-host filters/actions +(example user)
+specifies the encoding of the log files +handled by the jail This is used to +decode the lines from the log file. +Typical examples: "ascii", +"utf-8" +auto: will use the system locale setting
+enables the jails. +By default all jails are disabled, and it should stay +this way. +Enable only relevant to your setup jails in your .local or +jail.d/*.conf +true: jail will be enabled and log files will get monitored +for changes +false: jail is not enabled
+defines the filter to use by the jail. +By default jails have names matching +their filter name
+Destination email address used solely for the +interpolations in +jail.conf,local,d/* configuration files.
+Sender email address used solely for some actions
+E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA +for the mailing. +Change mta configuration parameter to mail if you want to +revert to +conventional 'mail'.
+Default protocol.
+Specify chain where jumps would need to be added in +iptables-* actions.
+in a particular jail
+Format of user-agent +tools.ietf.org/html/rfc7231#section-5.5.3
-48 -49 -50 -51 -52 -53 -54 -55 -56 -57 -58 -59 -60 -61 -62 -63 -64 -65 -66 -67 -68 -69 -70 -71 -72 -73 -74 -75 -76 -77 -78 -79 -80 -81 -82 -83 -84 -85 -86 -87 -88 -89 -90 -91 -92 -93 -94 -95+104 +105 +106 +107 +108 +109 +110 +111 +112 +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184
# File 'manifests/params.pp', line 48 +# File 'manifests/params.pp', line 104 class cd_fail2ban::params ( @@ -405,6 +815,9 @@ $pkg_ensure = 'latest', $fn_manage_config = true, $fn_enable_service = 'running', + +# fail2ban.conf/local + $fn_loglevel = 'INFO', $fn_logtarget = 'SYSLOG', $fn_syslogsocket = 'auto', @@ -413,16 +826,41 @@ $fn_pidfile = '/var/run/fail2ban/fail2ban.pid', $fn_dbfile = '/var/lib/fail2ban/fail2ban.sqlite3', $fn_dbpurgeage = '86400', +# jail.conf/local +$fn_ignoreip = '127.0.0.1/8', +$fn_ignorecommand = '', +$fn_bantime = '600', +$fn_findtime = '600', +$fn_maxretry = '5', +$fn_backend = 'auto', +$fn_usedns = 'warn', +$fn_logencoding = 'auto', +$fn_enabled = 'false', +$fn_filter = '%(__name__)s', +$fn_destemail = 'root@localhost', +$fn_sender = 'root@localhost', +$fn_mta = 'sendmail', +$fn_protocol = 'tcp', +$fn_chain = 'INPUT', +$fn_port = '0:65535', +$fn_fail2ban_agent = 'Fail2Ban/%(fail2ban_version)s', + ) { # installation section -$reqpackages = $::operatingsystem ? { +$reqpackages = $::operatingsystem ? { /(?i-mx:centos|fedora|redhat)/ => ['fail2ban','fail2ban-firewalld', 'fail2ban-sendmail', - 'fail2ban-server.noarch'], + 'fail2ban-server.noarch','jwhois'], } +$fn_jail_paths = $::operatingsystem ? { + /(?i-mx:centos|fedora|redhat)/ => 'fedora', + } + +# shortcuts +$fn_os = $::operatingsystem # service $fn_service = 'fail2ban' @@ -441,6 +879,11 @@ $fn_fail2ban_conf_file = "${fn_main_dir}/fail2ban.conf" $fn_fail2ban_conf_erb = 'cd_fail2ban/fail2ban_conf.erb' $fn_fail2ban_local_file = "${fn_main_dir}/fail2ban.local" $fn_fail2ban_local_erb = 'cd_fail2ban/fail2ban_local.erb' +$fn_jail_conf_file = "${fn_main_dir}/jail.conf" +$fn_jail_conf_erb = 'cd_fail2ban/jail_conf.erb' +$fn_jail_local_file = "${fn_main_dir}/jail.local" +$fn_jail_local_erb = 'cd_fail2ban/jail_local.erb' + # includes must be last @@ -454,7 +897,7 @@ $fn_fail2ban_local_erb = 'cd_fail2ban/fail2ban_local.erb' diff --git a/doc/top-level-namespace.html b/doc/top-level-namespace.html index 4af7cea..136fa21 100644 --- a/doc/top-level-namespace.html +++ b/doc/top-level-namespace.html @@ -90,7 +90,7 @@ diff --git a/tests/UTF_Files b/tests/UTF_Files index a138597..4319827 100644 --- a/tests/UTF_Files +++ b/tests/UTF_Files @@ -4,3 +4,4 @@ ./.yardoc/objects/root.dat: data ./doc/css/style.css: HTML document, UTF-8 Unicode text, with very long lines ./doc/js/jquery.js: HTML document, UTF-8 Unicode text, with very long lines +./doc/puppet_classes/cd_fail2ban_3A_3Aparams.html: HTML document, UTF-8 Unicode text