added more file controls

manifests/params.pp

@@ -44,13 +44,72 @@
 #   A value of "None" disables the database.
 # @param  [string] fn_dbpurgeage age in seconds at which bans should be purged
 #   from the database.
-##############################################################################
+# @param  [string] fn_ignoreip can be an IP address, a CIDR mask or a DNS host.
+#   Fail2ban will not ban a host which matches an address in this list. Several
+#   addresses can be defined using space (and/or comma) separator.
+# @param  [string] fn_ignorecommand External command that will take an
+#   tagged arguments to ignore, e.g. <ip>,and return true if the IP is to be
+#   ignored. False otherwise.
+# @param  [string] fn_bantime number of seconds that a host is banned.
+# @param  [string] fn_findtime A host is banned if it has generated "maxretry"
+#   during the last "findtime" seconds.
+# @param  [string] fn_maxretry number of failures before a host get banned.
+# @param  [string] fn_backend specifies the backend used to get files
+#   modification. options are "pyinotify", "gamin", "polling", "systemd" and
+#   "auto".
+#   pyinotify: requires pyinotify (a file alteration monitor) to be installed.
+#              If pyinotify is not installed, Fail2ban will use auto.
+#   gamin:     requires Gamin (a file alteration monitor) to be installed.
+#              If Gamin is not installed, Fail2ban will use auto.
+#   polling:   uses a polling algorithm which does not require external libraries.
+#   systemd:   uses systemd python library to access the systemd journal.
+#              Specifying "logpath" is not valid for this backend.
+#              See "journalmatch" in the jails associated filter config
+#   auto:      will try to use the following backends, in order:
+#              pyinotify, gamin, polling.
+# @param  [string] fn_usedns specifies if jails should trust hostnames in logs,
+#   warn when DNS lookups are performed, or ignore all hostnames in logs
+#   yes:   if a hostname is encountered, a DNS lookup will be performed.
+#   warn:  if a hostname is encountered, a DNS lookup will be performed,
+#        but it will be logged as a warning.
+#   no:    if a hostname is encountered, will not be used for banning,
+#        but it will be logged as info.
+#   raw:   use raw value (no hostname), allow use it for no-host filters/actions
+#   (example user)
+# @param  [string] fn_logencoding specifies the encoding of the log files
+#   handled by the jail This is used to decode the lines from the log file.
+#   Typical examples:  "ascii", "utf-8"
+#   auto:   will use the system locale setting
+# @param  [string] fn_enabled enables the jails.
+#   By default all jails are disabled, and it should stay this way.
+#   Enable only relevant to your setup jails in your .local or jail.d/*.conf
+#   true:  jail will be enabled and log files will get monitored for changes
+#   false: jail is not enabled
+# @param  [string]  fn_filter defines the filter to use by the jail.
+#   By default jails have names matching their filter name
+# @param  [string]  fn_destemail Destination email address used solely for the
+#   interpolations in jail.{conf,local,d/*} configuration files.
+# @param  [string] fn_sender Sender email address used solely for some actions
+# @param  [string] fn_mta E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA
+#   for the mailing. Change mta configuration parameter to mail if you want to
+#   revert to conventional 'mail'.
+# @param  [string]  fn_protocol Default protocol.
+# @param  [string] fn_chain Specify chain where jumps would need to be added in
+#   iptables-* actions.
+# @param  [string]  fn_port # Ports to be banned Usually should be overridden
+#   in a particular jail
+# @param  [string] fn_fail2ban_agent Format of user-agent
+#   https://tools.ietf.org/html/rfc7231#section-5.5.3
+###############################################################################
 class cd_fail2ban::params (
 
 $pkg_ensure             = 'latest',
 
 $fn_manage_config       = true,
 $fn_enable_service      = 'running',
+
+# fail2ban.conf/local
+
 $fn_loglevel            = 'INFO',
 $fn_logtarget           = 'SYSLOG',
 $fn_syslogsocket        = 'auto',
@@ -59,16 +118,41 @@ $fn_pidfile             = '/var/run/fail2ban/fail2ban.pid',
 $fn_dbfile              = '/var/lib/fail2ban/fail2ban.sqlite3',
 $fn_dbpurgeage          = '86400',
 
+# jail.conf/local
+$fn_ignoreip            = '127.0.0.1/8',
+$fn_ignorecommand       = '',
+$fn_bantime             = '600',
+$fn_findtime            = '600',
+$fn_maxretry            = '5',
+$fn_backend             = 'auto',
+$fn_usedns              = 'warn',
+$fn_logencoding         = 'auto',
+$fn_enabled             = 'false',
+$fn_filter              = '%(__name__)s',
+$fn_destemail           = 'root@localhost',
+$fn_sender              = 'root@localhost',
+$fn_mta                 = 'sendmail',
+$fn_protocol            = 'tcp',
+$fn_chain               = 'INPUT',
+$fn_port                = '0:65535',
+$fn_fail2ban_agent      = 'Fail2Ban/%(fail2ban_version)s',
+
 
 ) {
 
 # installation section
-$reqpackages  = $::operatingsystem ? {
+$reqpackages    = $::operatingsystem ? {
     /(?i-mx:centos|fedora|redhat)/ => ['fail2ban','fail2ban-firewalld',
                                         'fail2ban-sendmail',
                                         'fail2ban-server.noarch'],
   }
 
+$fn_jail_paths    = $::operatingsystem ? {
+    /(?i-mx:centos|fedora|redhat)/ => ['fedora'],
+  }
+
+# shortcuts
+$fn_os                  = $::operatingsystem
 
 # service
 $fn_service             = 'fail2ban'
@@ -87,6 +171,10 @@ $fn_fail2ban_conf_file  = "${fn_main_dir}/fail2ban.conf"
 $fn_fail2ban_conf_erb   = 'cd_fail2ban/fail2ban_conf.erb'
 $fn_fail2ban_local_file = "${fn_main_dir}/fail2ban.local"
 $fn_fail2ban_local_erb  = 'cd_fail2ban/fail2ban_local.erb'
+$fn_jail_conf_file      = "${fn_main_dir}/jail.conf"
+$fn_jail_conf_erb       = 'cd_fail2ban/jail_conf.erb'
+
+
 
 # includes must be last