Documentation by YARD 0.9.36
-Alphabetic Index
- -Puppet Class Listing A-Z
- - -
-
-
-
|
-
File Listing
--
-
-
-
- README - - -
diff --git a/.gitignore b/.gitignore index a356406..93e15e4 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,5 @@ Gemfile.lock FileList .scannerwork +.vscode +.puppet-lint \ No newline at end of file diff --git a/.puppet-lint.rc b/.puppet-lint.rc new file mode 100644 index 0000000..24728eb --- /dev/null +++ b/.puppet-lint.rc @@ -0,0 +1,2 @@ +--no-variable_scope-check +--no-top_scope_facts \ No newline at end of file diff --git a/Jenkinsfile b/Jenkinsfile index d5cae5a..9946609 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -1,7 +1,5 @@ pipeline { - agent { - label 'puppet' - } + agent any post { always { @@ -69,7 +67,7 @@ pipeline { withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) { sh ''' /opt/sonar-scanner/bin/sonar-scanner \ - -Dsonar.projectKey=fail2ban_cd \ + -Dsonar.projectKey=confdroid_fail2ban \ -Dsonar.sources=. \ -Dsonar.host.url=https://sonarqube.confdroid.com \ -Dsonar.token=$SONAR_TOKEN @@ -88,18 +86,38 @@ pipeline { steps { sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) { sh ''' - git config user.name "Jenkins Server" - git config user.email jenkins@confdroid.com - git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit" - git push -o merge_request.create \ - -o merge_request.target=master \ - -o merge_request.title="Auto-merge for build $BUILD_NUMBER" \ - -o merge_request.description="Automated changes from Jenkins build $BUILD_NUMBER" \ - -o merge_request.merge_when_pipeline_succeeds=true \ - origin jenkins-build-$BUILD_NUMBER + git config user.name "Jenkins Server" + git config user.email jenkins@confdroid.com + git rm -r --cached .vscode || echo "No .vscode to remove from git" + git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit" + git push origin HEAD:master ''' } } } + stage('Mirror to Gitea') { + steps { + withCredentials([usernamePassword( + credentialsId: 'Jenkins-gitea', + usernameVariable: 'GITEA_USER', + passwordVariable: 'GITEA_TOKEN')]) { + script { + // Checkout from GitLab (already done implicitly) + sh ''' + git checkout master + git pull origin master + git branch -D development + git branch -D jenkins-build-$BUILD_NUMBER + git rm -f Jenkinsfile + git rm -r --cached .vscode || echo "No .vscode to remove from git" + git commit --amend --no-edit --allow-empty + git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_fail2ban.git + git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \ + push master --mirror + ''' + } + } + } + } } } \ No newline at end of file diff --git a/README.md b/README.md index 7fdc25a..952e5cd 100644 --- a/README.md +++ b/README.md @@ -1,14 +1,26 @@ # Readme -[](https://jenkins.confdroid.com/job/fail2ban_cd/) +[](https://jenkins.confdroid.com/job/confdroid_fail2ban/) -[[_TOC_]] +- [Readme](#readme) + - [Synopsis](#synopsis) + - [WARNING](#warning) + - [Features](#features) + - [Dependencies](#dependencies) + - [Deployment](#deployment) + - [Parameters](#parameters) + - [SELINUX](#selinux) + - [Known Problems](#known-problems) + - [Support](#support) + - [Tests](#tests) + - [Contact Us](#contact-us) + - [Disclaimer](#disclaimer) ## Synopsis Fail2Ban is an intrusion prevention software framework that protects computer servers from brute-force attacks. -`fail2ban_cd` is a Puppet module to automate installation, configuration and management of fail2ban settings and rules. +`confdroid_fail2ban` is a Puppet module to automate installation, configuration and management of fail2ban settings and rules. ## WARNING @@ -18,27 +30,26 @@ Fail2Ban is an intrusion prevention software framework that protects computer se Installation -* install required binaries +- install required binaries Configuration -* manage directory structure (file system permissions, selinux context) -* manage configuration files (file system permissions, selinux context, content based on parameters) +- manage directory structure (file system permissions, selinux context) +- manage configuration files (file system permissions, selinux context, content based on parameters) Service -* manage service status +- manage service status ## Dependencies All dependencies must be included in the catalogue. -* [cd_resources](https://gitlab.confdroid.com/puppet/cd_resources) to manage yum base repos -* [cd_firewall](https://gitlab.confdroid.com/puppet/cd_firewall) or puppetlabs-firewall to manage firewall settings (optional) +- puppetlabs-firewall to manage firewall settings (optional) ## Deployment -* native Puppet deployment +- native Puppet deployment via site.pp or nodes.pp @@ -48,9 +59,9 @@ node 'example.example.net' { } ``` -* through Foreman: +- through Foreman: -In order to apply parameters through Foreman, **__fail2ban_cd::params__** must be added to the host or host group in question. +In order to apply parameters through Foreman, **__confdroid_fail2ban::params__** must be added to the host or host group in question. See [more details about class deployment on Confdroid.com](https://confdroid.com/2017/05/deploying-our-puppet-modules/). @@ -64,25 +75,24 @@ All files and directories are configured with correct selinux context. If selinu ## Known Problems -* firewalld: firewalld is auto-installed on CentOS7 as dependency of fail2ban by yum. - ## Support -* OS: Rocky 9 -* Puppet 8 +- OS: Rocky 9 +- Puppet 8 ## Tests -* Puppet Lint - * excluded tests: - * `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters. -* Puppet Parser -* ERB Template Parser -* Sonar Quality Gate +- Puppet Lint + - excluded tests: + - `--no-variable_scope-check`: not applicable as we are inheriting parameters from params class. the lint check does not distinguish between facts and inherited parameters. +- Puppet Parser +- ERB Template Parser +- Sonar Quality Gate ## Contact Us [contact Us](https://confdroid.com/contact/) +[Feedback Portal](https://feedback.confdroid.com/) ## Disclaimer diff --git a/doc/_index.html b/doc/_index.html deleted file mode 100644 index bede303..0000000 --- a/doc/_index.html +++ /dev/null @@ -1,143 +0,0 @@ - - -
- - -
-
-
-
|
-
| t |
- - - -6 -7 -8- |
-
- # File 'manifests/init.pp', line 6
-
-class fail2ban_cd {
- include fail2ban_cd::params
-}
- |
-
fail2ban_cd::main::config.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com)
- -
- - - -6 -7 -8 -9 -10- |
-
- # File 'manifests/main/config.pp', line 6
-
-class fail2ban_cd::main::config (
-
-) inherits fail2ban_cd::params {
- include fail2ban_cd::main::service
-}
- |
-
fail2ban_cd::main::dirs.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com)
- -
- - - -6 -7 -8 -9 -10 -11 -12 -13 -14 -15 -16 -17 -18 -19 -20 -21 -22 -23 -24 -25 -26 -27 -28 -29 -30 -31 -32 -33 -34 -35 -36 -37 -38 -39 -40 -41 -42 -43 -44 -45 -46 -47 -48 -49 -50 -51 -52 -53 -54 -55 -56 -57 -58 -59 -60 -61 -62 -63 -64 -65 -66 -67 -68 -69 -70 -71 -72 -73 -74 -75 -76 -77 -78 -79 -80 -81 -82 -83 -84 -85 -86 -87 -88 -89 -90 -91 -92 -93 -94 -95 -96 -97 -98 -99 -100 -101 -102 -103 -104 -105 -106 -107 -108- |
-
- # File 'manifests/main/dirs.pp', line 6
-
-class fail2ban_cd::main::dirs (
-
-) inherits fail2ban_cd::params {
- require fail2ban_cd::main::install
-
- # manage main dir
-
- file { $fn_main_dir:
- ensure => directory,
- path => $fn_main_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- }
-
- # manage action.d dir
-
- file { $fn_action_d_dir:
- ensure => directory,
- path => $fn_action_d_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- }
-
- # manage fail2ban.d dir
-
- file { $fn_fail2ban_d_dir:
- ensure => directory,
- path => $fn_fail2ban_d_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- }
-
- # manage filter.d dir
-
- file { $fn_filter_d_dir:
- ensure => directory,
- path => $fn_filter_d_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- }
-
- # manage jail.d dir
-
- file { $fn_jail_d_dir:
- ensure => directory,
- path => $fn_jail_d_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- }
-
- # manage /var/lib/fail2ban
-
- file { $fn_var_lib_dir:
- ensure => directory,
- path => $fn_var_lib_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => fail2ban_var_lib_t,
- seluser => system_u,
- }
-
- # manage /var/run/fail2bam
-
- file { $fn_var_run_dir:
- ensure => directory,
- path => $fn_var_run_dir,
- owner => 'root',
- group => 'root',
- mode => '0755',
- selrange => s0,
- selrole => object_r,
- seltype => fail2ban_var_run_t,
- seluser => system_u,
- }
-}
- |
-
fail2ban_cd::main::files.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com)
- -
- - - -6 -7 -8 -9 -10 -11 -12 -13 -14 -15 -16 -17 -18 -19 -20 -21 -22 -23 -24 -25 -26 -27 -28 -29 -30 -31 -32 -33 -34 -35 -36 -37 -38 -39 -40 -41 -42 -43 -44 -45 -46 -47 -48 -49 -50 -51 -52 -53 -54 -55 -56 -57 -58 -59 -60 -61 -62 -63 -64 -65 -66 -67 -68 -69 -70 -71 -72 -73 -74 -75 -76 -77 -78 -79 -80 -81 -82 -83 -84 -85 -86 -87 -88 -89 -90 -91 -92- |
-
- # File 'manifests/main/files.pp', line 6
-
-class fail2ban_cd::main::files (
-
-) inherits fail2ban_cd::params {
- require fail2ban_cd::main::dirs
-
- if $fn_manage_config == true {
- # manage fail2ban.conf
-
- file { $fn_fail2ban_conf_file:
- ensure => file,
- path => $fn_fail2ban_conf_file,
- owner => 'root',
- group => 'root',
- mode => '0640',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- content => template($fn_fail2ban_conf_erb),
- notify => Service[$fn_service],
- }
-
- # manage fail2ban.local
-
- file { $fn_fail2ban_local_file:
- ensure => file,
- path => $fn_fail2ban_local_file,
- owner => 'root',
- group => 'root',
- mode => '0640',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- content => template($fn_fail2ban_local_erb),
- notify => Service[$fn_service],
- }
-
- # manage jail.conf
-
- file { $fn_jail_conf_file:
- ensure => file,
- path => $fn_jail_conf_file,
- owner => 'root',
- group => 'root',
- mode => '0640',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- content => template($fn_jail_conf_erb),
- notify => Service[$fn_service],
- }
-
- # manage jail.local
-
- file { $fn_jail_local_file:
- ensure => file,
- path => $fn_jail_local_file,
- owner => 'root',
- group => 'root',
- mode => '0640',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- content => template($fn_jail_local_erb),
- notify => Service[$fn_service],
- }
-
- # manage paths-common.conf
-
- file { $fn_paths_common_file:
- ensure => file,
- path => $fn_paths_common_file,
- owner => 'root',
- group => 'root',
- mode => '0640',
- selrange => s0,
- selrole => object_r,
- seltype => etc_t,
- seluser => system_u,
- content => template($fn_paths_common_erb),
- notify => Service[$fn_service],
- }
- }
-}
- |
-
fail2ban_cd::main::install.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com)
- -
- - - -6 -7 -8 -9 -10 -11 -12 -13 -14- |
-
- # File 'manifests/main/install.pp', line 6
-
-class fail2ban_cd::main::install (
-
-) inherits fail2ban_cd::params {
-# require cd_resources
-
- package { $reqpackages:
- ensure => $pkg_ensure,
- }
-}
- |
-
fail2ban_cd::main::service.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com)
- -
- - - -6 -7 -8 -9 -10 -11 -12 -13 -14 -15 -16 -17- |
-
- # File 'manifests/main/service.pp', line 6
-
-class fail2ban_cd::main::service (
-
-) inherits fail2ban_cd::params {
- require fail2ban_cd::main::files
-
- service { $fn_service:
- ensure => $fn_enable_service,
- hasstatus => true,
- hasrestart => true,
- enable => true,
- }
-}
- |
-
fail2ban_cd::params.pp Module name: fail2ban_cd Author: Arne Teuke (arne_teuke@confdroid.com) CRITICAL,ERROR,WARNING,NOTICE,INFO and DEBUG.
- - - -104 -105 -106 -107 -108 -109 -110 -111 -112 -113 -114 -115 -116 -117 -118 -119 -120 -121 -122 -123 -124 -125 -126 -127 -128 -129 -130 -131 -132 -133 -134 -135 -136 -137 -138 -139 -140 -141 -142 -143 -144 -145 -146 -147 -148 -149 -150 -151 -152 -153 -154 -155 -156 -157 -158 -159 -160 -161 -162 -163 -164 -165 -166 -167 -168 -169 -170 -171 -172 -173 -174 -175 -176 -177 -178 -179 -180 -181 -182 -183 -184 -185 -186 -187 -188 -189 -190 -191 -192- |
-
- # File 'manifests/params.pp', line 104
-
-class fail2ban_cd::params (
-
-# installation
- String $pkg_ensure = 'latest',
- Array $reqpackages = ['fail2ban','fail2ban-firewalld',
- 'fail2ban-sendmail','fail2ban-server.noarch','whois'],
-
- Boolean $fn_manage_config = true,
- String $fn_enable_service = 'running',
-
-# fail2ban.conf/local
-
- String $fn_loglevel = 'INFO',
- String $fn_logtarget = 'SYSLOG',
- String $fn_syslogsocket = 'auto',
- String $fn_socket = '/var/run/fail2ban/fail2ban.sock',
- String $fn_pidfile = '/var/run/fail2ban/fail2ban.pid',
- String $fn_dbfile = '/var/lib/fail2ban/fail2ban.sqlite3',
- String $fn_dbpurgeage = '86400',
-
-# jail.conf/local
- String $fn_ignoreip = '127.0.0.1/8',
- String $fn_ignorecommand = '',
- String $fn_bantime = '600',
- String $fn_findtime = '600',
- String $fn_maxretry = '5',
- String $fn_backend = 'auto',
- String $fn_usedns = 'warn',
- String $fn_logencoding = 'auto',
- Boolean $fn_enabled = false,
- String $fn_filter = '%(__name__)s',
- String $fn_destemail = 'root@localhost',
- #String $fn_sender = "fail2ban@${fqdn}",
- String $fn_mta = 'sendmail',
- String $fn_protocol = 'tcp',
- String $fn_chain = 'INPUT',
- String $fn_port = '0:65535',
- String $fn_fail2ban_agent = 'Fail2Ban/%(fail2ban_version)s',
- String $fn_banaction = 'iptables-multiport',
- String $fn_banaction_allports = 'iptables-allports',
- String $fn_action_ = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]',
- String $fn_action_mw = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
- %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]',
- String $fn_action_mwl = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
- %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
- String $fn_action_xarf = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
- xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]',
- String $fn_action_cf_mwl = 'cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
- %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
- String $fn_action_blocklist_de = 'blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]',
- String $fn_action_badips = 'badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]',
- String $fn_action_badips_report = 'badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]',
- String $fn_default_action = 'action_',
- String $fn_jail_paths = 'fedora',
-
-) {
-# shortcuts
- $fqdn = $facts['networking']['fqdn']
- $fn_os = $facts['os']
- $fn_sender = "fail2ban@${fqdn}"
-
-# service
- $fn_service = 'fail2ban'
-
-# directories
- $fn_main_dir = '/etc/fail2ban'
- $fn_action_d_dir = "${fn_main_dir}/action.d"
- $fn_fail2ban_d_dir = "${fn_main_dir}/fail2ban.d"
- $fn_filter_d_dir = "${fn_main_dir}/filter.d"
- $fn_jail_d_dir = "${fn_main_dir}/jail.d"
- $fn_var_lib_dir = '/var/lib/fail2ban'
- $fn_var_run_dir = '/var/run/fail2ban'
-
-# files
- $fn_fail2ban_conf_file = "${fn_main_dir}/fail2ban.conf"
- $fn_fail2ban_conf_erb = 'fail2ban_cd/fail2ban_conf.erb'
- $fn_fail2ban_local_file = "${fn_main_dir}/fail2ban.local"
- $fn_fail2ban_local_erb = 'fail2ban_cd/fail2ban_local.erb'
- $fn_jail_conf_file = "${fn_main_dir}/jail.conf"
- $fn_jail_conf_erb = 'fail2ban_cd/jail_conf.erb'
- $fn_jail_local_file = "${fn_main_dir}/jail.local"
- $fn_jail_local_erb = 'fail2ban_cd/jail_local.erb'
- $fn_paths_common_file = "${fn_main_dir}/paths-common.conf"
- $fn_paths_common_erb = 'fail2ban_cd/paths_common_conf.erb'
-
-# includes must be last
-
- include fail2ban_cd::main::config
-}
- |
-