added controls for main conf/local files

templates/fail2ban_conf.erb

@@ -0,0 +1,77 @@
+################################################################################
+##########              fail2ban.conf managed by Puppet               ##########
+##########            manual changes will be overwritten !!!          ##########
+################################################################################
+##########              full reference available under                ##########
+##########   https://confdroid.com/2017/08/fail2ban-fail2ban-conf/    ##########
+################################################################################
+
+# Fail2Ban main configuration file
+#
+# Comments: use '#' for comment lines and ';' (following a space) for inline comments
+#
+# Changes:  in most of the cases you should not modify this
+#           file, but provide customizations in fail2ban.local file, e.g.:
+#
+# [Definition]
+# loglevel = DEBUG
+#
+
+[Definition]
+
+# Option: loglevel
+# Notes.: Set the log level output.
+#         CRITICAL
+#         ERROR
+#         WARNING
+#         NOTICE
+#         INFO
+#         DEBUG
+# Values: [ LEVEL ]  Default: ERROR
+#
+loglevel = INFO
+
+# Option: logtarget
+# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
+#         Only one log target can be specified.
+#         If you change logtarget from the default value and you are
+#         using logrotate -- also adjust or disable rotation in the
+#         corresponding configuration file
+#         (e.g. /etc/logrotate.d/fail2ban on Debian systems)
+# Values: [ STDOUT | STDERR | SYSLOG | FILE ]  Default: STDERR
+#
+logtarget = /var/log/fail2ban.log
+
+# Option: syslogsocket
+# Notes: Set the syslog socket file. Only used when logtarget is SYSLOG
+#        auto uses platform.system() to determine predefined paths
+# Values: [ auto | FILE ]  Default: auto
+syslogsocket = auto
+
+# Option: socket
+# Notes.: Set the socket file. This is used to communicate with the daemon. Do
+#         not remove this file when Fail2ban runs. It will not be possible to
+#         communicate with the server afterwards.
+# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.sock
+#
+socket = /var/run/fail2ban/fail2ban.sock
+
+# Option: pidfile
+# Notes.: Set the PID file. This is used to store the process ID of the
+#         fail2ban server.
+# Values: [ FILE ]  Default: /var/run/fail2ban/fail2ban.pid
+#
+pidfile = /var/run/fail2ban/fail2ban.pid
+
+# Options: dbfile
+# Notes.: Set the file for the fail2ban persistent data to be stored.
+#         A value of ":memory:" means database is only stored in memory
+#         and data is lost when fail2ban is stopped.
+#         A value of "None" disables the database.
+# Values: [ None :memory: FILE ] Default: /var/lib/fail2ban/fail2ban.sqlite3
+dbfile = /var/lib/fail2ban/fail2ban.sqlite3
+
+# Options: dbpurgeage
+# Notes.: Sets age at which bans should be purged from the database
+# Values: [ SECONDS ] Default: 86400 (24hours)
+dbpurgeage = 86400

templates/fail2ban_local.erb

@@ -0,0 +1,16 @@
+################################################################################
+##########              fail2ban.local managed by Puppet              ##########
+##########            manual changes will be overwritten !!!          ##########
+################################################################################
+##########              full reference available under                ##########
+##########   https://confdroid.com/2017/08/fail2ban-fail2ban-conf/    ##########
+################################################################################
+
+[Definition]
+loglevel      = <%= @fn_loglevel %>
+logtarget     = <%= @fn_logtarget %>
+syslogsocket  = <%= @fn_syslogsocket %>
+socket        = <%= @fn_socket %>
+pidfile       = <%= @fn_pidfile %>
+dbfile        = <%= @fn_dbfile %>
+dbpurgeage    = <%= @fn_dbpurgeage %>