Documentation by YARD 0.9.36
+Alphabetic Index
+ +Puppet Class Listing A-Z
+ + +
+
+
+
|
+
File Listing
+-
+
+
+
- README + + +
diff --git a/Jenkinsfile b/Jenkinsfile deleted file mode 100644 index 9946609..0000000 --- a/Jenkinsfile +++ /dev/null @@ -1,123 +0,0 @@ -pipeline { - agent any - - post { - always { - deleteDir() /* clean up our workspace */ - } - success { - updateGitlabCommitStatus state: 'success' - } - failure { - updateGitlabCommitStatus state: 'failed' - step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: 'support@confdroid.com', sendToIndividuals: true]) - } - } - - options { - gitLabConnection('gitlab.confdroid.com') - } - - stages { - - stage('pull master') { - steps { - sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) { - sh ''' - git config user.name "Jenkins Server" - git config user.email jenkins@confdroid.com - # Ensure we're on the development branch (triggered by push) - git checkout development - # Create jenkins branch from development - git checkout -b jenkins-build-$BUILD_NUMBER - # Optionally merge master into jenkins to ensure compatibility - git merge origin/master --no-ff || { echo "Merge conflict detected"; exit 1; } - ''' - } - } - } - - stage('puppet parser') { - steps { - sh '''for file in $(find . -iname \'*.pp\'); do - /opt/puppetlabs/bin/puppet parser validate --color false --render-as s --modulepath=modules $file || exit 1; - done;''' - } - } - - stage('check templates') { - steps{ - sh '''for file in $(find . -iname \'*.erb\'); - do erb -P -x -T "-" $file | ruby -c || exit 1; - done;''' - } - } - - stage('puppet-lint') { - steps { - sh '''/usr/local/bin/puppet-lint . \\ - --no-variable_scope-check \\ - || { echo "Puppet lint failed"; exit 1; } - ''' - } - } - - stage('SonarScan') { - steps { - withCredentials([string(credentialsId: 'sonar-token', variable: 'SONAR_TOKEN')]) { - sh ''' - /opt/sonar-scanner/bin/sonar-scanner \ - -Dsonar.projectKey=confdroid_fail2ban \ - -Dsonar.sources=. \ - -Dsonar.host.url=https://sonarqube.confdroid.com \ - -Dsonar.token=$SONAR_TOKEN - ''' - } - } - } - - stage('create Puppet documentation') { - steps { - sh '/opt/puppetlabs/bin/puppet strings' - } - } - - stage('update repo') { - steps { - sshagent(['edd05eb6-26b5-4c7b-a5cc-ea2ab899f4fa']) { - sh ''' - git config user.name "Jenkins Server" - git config user.email jenkins@confdroid.com - git rm -r --cached .vscode || echo "No .vscode to remove from git" - git add -A && git commit -am "Recommit for updates in build $BUILD_NUMBER" || echo "No changes to commit" - git push origin HEAD:master - ''' - } - } - } - stage('Mirror to Gitea') { - steps { - withCredentials([usernamePassword( - credentialsId: 'Jenkins-gitea', - usernameVariable: 'GITEA_USER', - passwordVariable: 'GITEA_TOKEN')]) { - script { - // Checkout from GitLab (already done implicitly) - sh ''' - git checkout master - git pull origin master - git branch -D development - git branch -D jenkins-build-$BUILD_NUMBER - git rm -f Jenkinsfile - git rm -r --cached .vscode || echo "No .vscode to remove from git" - git commit --amend --no-edit --allow-empty - git remote add master https://sourcecode.confdroid.com/confdroid/confdroid_fail2ban.git - git -c credential.helper="!f() { echo username=${GITEA_USER}; echo password=${GITEA_TOKEN}; }; f" \ - push master --mirror - ''' - } - } - } - } - } -} \ No newline at end of file diff --git a/doc/_index.html b/doc/_index.html new file mode 100644 index 0000000..dfccf3e --- /dev/null +++ b/doc/_index.html @@ -0,0 +1,148 @@ + + +
+ + +
+
+
+
|
+
| t |
+ + + +6 +7 +8+ |
+
+ # File 'manifests/init.pp', line 6
+
+class confdroid_fail2ban {
+ include confdroid_fail2ban::params
+}
+ |
+
confdroid_fail2ban::main::config.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12 +13+ |
+
+ # File 'manifests/main/config.pp', line 6
+
+class confdroid_fail2ban::main::config (
+
+) inherits confdroid_fail2ban::params {
+ include confdroid_fail2ban::main::service
+ if $fn_incl_target == true {
+ include confdroid_fail2ban::monitoring::target
+ }
+}
+ |
+
confdroid_fail2ban::main::dirs.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92 +93 +94 +95 +96 +97 +98 +99 +100 +101 +102 +103 +104 +105 +106 +107 +108+ |
+
+ # File 'manifests/main/dirs.pp', line 6
+
+class confdroid_fail2ban::main::dirs (
+
+) inherits confdroid_fail2ban::params {
+ require confdroid_fail2ban::main::install
+
+ # manage main dir
+
+ file { $fn_main_dir:
+ ensure => directory,
+ path => $fn_main_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ }
+
+ # manage action.d dir
+
+ file { $fn_action_d_dir:
+ ensure => directory,
+ path => $fn_action_d_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ }
+
+ # manage fail2ban.d dir
+
+ file { $fn_fail2ban_d_dir:
+ ensure => directory,
+ path => $fn_fail2ban_d_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ }
+
+ # manage filter.d dir
+
+ file { $fn_filter_d_dir:
+ ensure => directory,
+ path => $fn_filter_d_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ }
+
+ # manage jail.d dir
+
+ file { $fn_jail_d_dir:
+ ensure => directory,
+ path => $fn_jail_d_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ }
+
+ # manage /var/lib/fail2ban
+
+ file { $fn_var_lib_dir:
+ ensure => directory,
+ path => $fn_var_lib_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => fail2ban_var_lib_t,
+ seluser => system_u,
+ }
+
+ # manage /var/run/fail2bam
+
+ file { $fn_var_run_dir:
+ ensure => directory,
+ path => $fn_var_run_dir,
+ owner => 'root',
+ group => 'root',
+ mode => '0755',
+ selrange => s0,
+ selrole => object_r,
+ seltype => fail2ban_var_run_t,
+ seluser => system_u,
+ }
+}
+ |
+
confdroid_fail2ban::main::files.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23 +24 +25 +26 +27 +28 +29 +30 +31 +32 +33 +34 +35 +36 +37 +38 +39 +40 +41 +42 +43 +44 +45 +46 +47 +48 +49 +50 +51 +52 +53 +54 +55 +56 +57 +58 +59 +60 +61 +62 +63 +64 +65 +66 +67 +68 +69 +70 +71 +72 +73 +74 +75 +76 +77 +78 +79 +80 +81 +82 +83 +84 +85 +86 +87 +88 +89 +90 +91 +92+ |
+
+ # File 'manifests/main/files.pp', line 6
+
+class confdroid_fail2ban::main::files (
+
+) inherits confdroid_fail2ban::params {
+ require confdroid_fail2ban::main::dirs
+
+ if $fn_manage_config == true {
+ # manage fail2ban.conf
+
+ file { $fn_fail2ban_conf_file:
+ ensure => file,
+ path => $fn_fail2ban_conf_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_fail2ban_conf_erb),
+ notify => Service[$fn_service],
+ }
+
+ # manage fail2ban.local
+
+ file { $fn_fail2ban_local_file:
+ ensure => file,
+ path => $fn_fail2ban_local_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_fail2ban_local_erb),
+ notify => Service[$fn_service],
+ }
+
+ # manage jail.conf
+
+ file { $fn_jail_conf_file:
+ ensure => file,
+ path => $fn_jail_conf_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_jail_conf_erb),
+ notify => Service[$fn_service],
+ }
+
+ # manage jail.local
+
+ file { $fn_jail_local_file:
+ ensure => file,
+ path => $fn_jail_local_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_jail_local_erb),
+ notify => Service[$fn_service],
+ }
+
+ # manage paths-common.conf
+
+ file { $fn_paths_common_file:
+ ensure => file,
+ path => $fn_paths_common_file,
+ owner => 'root',
+ group => 'root',
+ mode => '0640',
+ selrange => s0,
+ selrole => object_r,
+ seltype => etc_t,
+ seluser => system_u,
+ content => template($fn_paths_common_erb),
+ notify => Service[$fn_service],
+ }
+ }
+}
+ |
+
confdroid_fail2ban::main::install.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12+ |
+
+ # File 'manifests/main/install.pp', line 6
+
+class confdroid_fail2ban::main::install (
+
+) inherits confdroid_fail2ban::params {
+ package { $fn_reqpackages:
+ ensure => $fn_pkg_ensure,
+ }
+}
+ |
+
confdroid_fail2ban::main::service.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17+ |
+
+ # File 'manifests/main/service.pp', line 6
+
+class confdroid_fail2ban::main::service (
+
+) inherits confdroid_fail2ban::params {
+ require confdroid_fail2ban::main::files
+
+ service { $fn_service:
+ ensure => $fn_enable_service,
+ hasstatus => true,
+ hasrestart => true,
+ enable => true,
+ }
+}
+ |
+
confdroid_fail2ban::monitoring::target.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@puppetsoft.com)
+ +
+ + + +6 +7 +8 +9 +10 +11 +12 +13 +14 +15 +16 +17 +18 +19 +20 +21 +22 +23+ |
+
+ # File 'manifests/monitoring/target.pp', line 6
+
+class confdroid_fail2ban::monitoring::target (
+
+) inherits confdroid_fail2ban::params {
+ if $fn_incl_target == true {
+ @@nagios_service { "check_fail2ban_${fqdn}":
+ check_command => "check_nrpe!check_fail2ban!${fn_procs_allowed}!fail2ban-server",
+ use => 'generic-service',
+ host_name => $fqdn,
+ notification_period => '24x7',
+ service_description => "${fqdn}_check_fail2ban",
+ target => $fn_target_service,
+ owner => 'nagios',
+ group => 'nagios',
+ mode => '0640',
+ contacts => $fn_target_contacts,
+ }
+ }
+}
+ |
+
confdroid_fail2ban::params.pp Module name: confdroid_fail2ban Author: 12ww1160 (12ww1160@confdroid.com) CRITICAL,ERROR,WARNING,NOTICE,INFO and DEBUG.
+ + + +113 +114 +115 +116 +117 +118 +119 +120 +121 +122 +123 +124 +125 +126 +127 +128 +129 +130 +131 +132 +133 +134 +135 +136 +137 +138 +139 +140 +141 +142 +143 +144 +145 +146 +147 +148 +149 +150 +151 +152 +153 +154 +155 +156 +157 +158 +159 +160 +161 +162 +163 +164 +165 +166 +167 +168 +169 +170 +171 +172 +173 +174 +175 +176 +177 +178 +179 +180 +181 +182 +183 +184 +185 +186 +187 +188 +189 +190 +191 +192 +193 +194 +195 +196 +197 +198 +199 +200 +201 +202 +203 +204 +205 +206+ |
+
+ # File 'manifests/params.pp', line 113
+
+class confdroid_fail2ban::params (
+
+# installation
+ String $fn_pkg_ensure = 'present',
+ Array $fn_reqpackages = ['fail2ban','fail2ban-firewalld',
+ 'fail2ban-sendmail','fail2ban-server.noarch','whois'],
+
+ Boolean $fn_manage_config = true,
+ String $fn_enable_service = 'running',
+
+# fail2ban.conf/local
+
+ String $fn_loglevel = 'INFO',
+ String $fn_logtarget = 'SYSLOG',
+ String $fn_syslogsocket = 'auto',
+ String $fn_socket = '/var/run/fail2ban/fail2ban.sock',
+ String $fn_pidfile = '/var/run/fail2ban/fail2ban.pid',
+ String $fn_dbfile = '/var/lib/fail2ban/fail2ban.sqlite3',
+ String $fn_dbpurgeage = '86400',
+
+# jail.conf/local
+ String $fn_ignoreip = '127.0.0.1/8',
+ Optional[String] $fn_ignorecommand = undef,
+ String $fn_bantime = '600',
+ String $fn_findtime = '600',
+ String $fn_maxretry = '5',
+ String $fn_backend = 'auto',
+ String $fn_usedns = 'warn',
+ String $fn_logencoding = 'auto',
+ Boolean $fn_enabled = false,
+ String $fn_filter = '%(__name__)s',
+ String $fn_destemail = 'root@localhost',
+ String $fn_mta = 'sendmail',
+ String $fn_protocol = 'tcp',
+ String $fn_chain = 'INPUT',
+ String $fn_port = '0:65535',
+ String $fn_fail2ban_agent = 'Fail2Ban/%(fail2ban_version)s',
+ String $fn_banaction = 'iptables-multiport',
+ String $fn_banaction_allports = 'iptables-allports',
+ String $fn_action_ = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]',
+ String $fn_action_mw = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+ %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]',
+ String $fn_action_mwl = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+ %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
+ String $fn_action_xarf = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+ xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]',
+ String $fn_action_cf_mwl = 'cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+ %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
+ String $fn_action_blocklist_de = 'blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]',
+ String $fn_action_badips = 'badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]',
+ String $fn_action_badips_report = 'badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]',
+ String $fn_default_action = 'action_',
+ String $fn_jail_paths = 'fedora',
+
+# nagios
+ Boolean $fn_incl_target = false,
+ String $fn_target_service = '/etc/nagios/conf.d/fail2ban_service.cfg',
+ String $fn_target_contacts = 'nagiosadmin',
+ String $fn_procs_allowed = '1:1',
+
+) {
+# shortcuts
+ $fqdn = $facts['networking']['fqdn']
+ $fn_os = $facts['os']
+ $fn_sender = "fail2ban@${fqdn}"
+
+# service
+ $fn_service = 'fail2ban'
+
+# directories
+ $fn_main_dir = '/etc/fail2ban'
+ $fn_action_d_dir = "${fn_main_dir}/action.d"
+ $fn_fail2ban_d_dir = "${fn_main_dir}/fail2ban.d"
+ $fn_filter_d_dir = "${fn_main_dir}/filter.d"
+ $fn_jail_d_dir = "${fn_main_dir}/jail.d"
+ $fn_var_lib_dir = '/var/lib/fail2ban'
+ $fn_var_run_dir = '/var/run/fail2ban'
+
+# files
+ $fn_fail2ban_conf_file = "${fn_main_dir}/fail2ban.conf"
+ $fn_fail2ban_conf_erb = 'confdroid_fail2ban/fail2ban_conf.erb'
+ $fn_fail2ban_local_file = "${fn_main_dir}/fail2ban.local"
+ $fn_fail2ban_local_erb = 'confdroid_fail2ban/fail2ban_local.erb'
+ $fn_jail_conf_file = "${fn_main_dir}/jail.conf"
+ $fn_jail_conf_erb = 'confdroid_fail2ban/jail_conf.erb'
+ $fn_jail_local_file = "${fn_main_dir}/jail.local"
+ $fn_jail_local_erb = 'confdroid_fail2ban/jail_local.erb'
+ $fn_paths_common_file = "${fn_main_dir}/paths-common.conf"
+ $fn_paths_common_erb = 'confdroid_fail2ban/paths_common_conf.erb'
+
+# includes must be last
+
+ include confdroid_fail2ban::main::config
+}
+ |
+