1147 lines
28 KiB
HTML
1147 lines
28 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
Puppet Class: cd_fail2ban::params
|
|
|
|
— Documentation by YARD 0.9.9
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="../css/style.css" type="text/css" charset="utf-8" />
|
|
|
|
<link rel="stylesheet" href="../css/common.css" type="text/css" charset="utf-8" />
|
|
|
|
<script type="text/javascript" charset="utf-8">
|
|
pathId = "puppet_classes::cd_fail2ban::params";
|
|
relpath = '../';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="../puppet_class_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="../_index.html">Index (c)</a> »
|
|
<span class='title'><span class='object_link'>Puppet Classes</span></span>
|
|
»
|
|
<span class="title">cd_fail2ban::params</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="puppet_class_list_link"
|
|
href="../puppet_class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><h1>Puppet Class: cd_fail2ban::params</h1>
|
|
<div class="box_info">
|
|
|
|
|
|
<dl>
|
|
<dt>Inherited by:</dt>
|
|
<dd>
|
|
|
|
<span class='object_link'><a href="cd_fail2ban_3A_3Amain_3A_3Adirs.html" title="puppet_classes::cd_fail2ban::main::dirs (puppet_class)">cd_fail2ban::main::dirs</a></span><br/>
|
|
|
|
<span class='object_link'><a href="cd_fail2ban_3A_3Amain_3A_3Afiles.html" title="puppet_classes::cd_fail2ban::main::files (puppet_class)">cd_fail2ban::main::files</a></span><br/>
|
|
|
|
<span class='object_link'><a href="cd_fail2ban_3A_3Amain_3A_3Aconfig.html" title="puppet_classes::cd_fail2ban::main::config (puppet_class)">cd_fail2ban::main::config</a></span><br/>
|
|
|
|
<span class='object_link'><a href="cd_fail2ban_3A_3Amain_3A_3Ainstall.html" title="puppet_classes::cd_fail2ban::main::install (puppet_class)">cd_fail2ban::main::install</a></span><br/>
|
|
|
|
<span class='object_link'><a href="cd_fail2ban_3A_3Amain_3A_3Aservice.html" title="puppet_classes::cd_fail2ban::main::service (puppet_class)">cd_fail2ban::main::service</a></span><br/>
|
|
|
|
</dd>
|
|
</dl>
|
|
|
|
<dl>
|
|
<dt>Defined in:</dt>
|
|
<dd>
|
|
manifests/params.pp
|
|
</dd>
|
|
</dl>
|
|
</div>
|
|
|
|
<h2>Summary</h2>
|
|
Class holds all parameters for the cd_fail2ban module and is
|
|
inherited by all classes except defines.
|
|
|
|
<h2>Overview</h2>
|
|
<div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>cd_fail2ban::params.pp
|
|
Module name: cd_fail2ban
|
|
Author: Arne Teuke
|
|
(arne_teuke@confdroid.com)
|
|
License:
|
|
This file is part of cd_fail2ban.</p>
|
|
|
|
<p>cd_fail2ban is used for providing automatic configuration of Fail2Ban
|
|
|
|
Copyright (C) 2017 confdroid (copyright@confdroid.com)
|
|
This program is
|
|
free software: you can redistribute it and/or modify
|
|
it under the terms of
|
|
the GNU General Public License as published by
|
|
the Free Software
|
|
Foundation, either version 3 of the License, or
|
|
(at your option) any later
|
|
version.</p>
|
|
|
|
<p>This program is distributed in the hope that it will be useful,
|
|
but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY
|
|
or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU General Public License
|
|
for more details.</p>
|
|
|
|
<p>You should have received a copy of the GNU General Public License
|
|
along
|
|
with this program. If not, see <a
|
|
href="http://www.gnu.org/licenses">www.gnu.org/licenses</a>/.
|
|
<code>CRITICAL</code>,<code>ERROR</code>,<code>WARNING</code>,<code>NOTICE</code>,<code>INFO</code>
|
|
and <code>DEBUG</code>.
|
|
@param [string] Report ban via badips.com, and use
|
|
as blacklist</p>
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
<p class="tag_title">Parameters:</p>
|
|
<ul class="param">
|
|
|
|
<li>
|
|
|
|
<span class='name'>pkg_ensure</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'latest'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>which <a href="https://confdroid.com/2017/05/puppet-type-package/">package
|
|
type</a>
|
|
to choose, i.e. <code>latest</code> or <code>present</code>.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_manage_config</span>
|
|
|
|
|
|
<span class='type'>(<tt>boolean</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>true</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Whether to manage the fail2ban
|
|
configuration files. If set to false,
|
|
fail2ban will be installed, but the
|
|
configuration will not be managed.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_enable_service</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'running'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Whether to enable/start or disable/stop
|
|
the fail2ban service. Valid options
|
|
are <code>running</code> or <code>stopped</code>.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_loglevel</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'INFO'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Set the log level output. Valid options are</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_logtarget</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'SYSLOG'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Set the log target. This could be a file,
|
|
SYSLOG, STDERR or STDOUT. Only
|
|
one log target can be specified.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_syslogsocket</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'auto'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Set the syslog socket file. Only used when
|
|
logtarget is SYSLOG. auto uses
|
|
platform.system() to determine predefined
|
|
paths Valid options: [ auto |
|
|
FILE ].</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_socket</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'/var/run/fail2ban/fail2ban.sock'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Set the socket file to communicate with the daemon.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_pidfile</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'/var/run/fail2ban/fail2ban.pid'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Set the PID file to store the process ID of the
|
|
fail2ban server.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_dbfile</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'/var/lib/fail2ban/fail2ban.sqlite3'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>file for the fail2ban persistent data to be stored.
|
|
A value of
|
|
":memory:" means database is only stored in memory
|
|
and data is
|
|
lost when fail2ban is stopped.
|
|
A value of "None" disables the
|
|
database.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_dbpurgeage</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'86400'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>age in seconds at which bans should be purged
|
|
from the database.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_ignoreip</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'127.0.0.1/8'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>can be an IP address, a CIDR mask or a DNS host.
|
|
Fail2ban will not ban a
|
|
host which matches an address in this list. Several
|
|
addresses can be
|
|
defined using space (and/or comma) separator.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_ignorecommand</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>''</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>External command that will take an
|
|
tagged arguments to ignore, e.g.
|
|
<ip>,and return true if the IP is to be
|
|
ignored. False otherwise.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_bantime</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'600'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>number of seconds that a host is banned.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_findtime</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'600'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>A host is banned if it has generated “maxretry”
|
|
during the last
|
|
"findtime" seconds.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_maxretry</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'5'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>number of failures before a host get banned.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_backend</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'auto'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>specifies the backend used to get files
|
|
modification. options are
|
|
"pyinotify", "gamin", "polling",
|
|
"systemd" and
|
|
"auto".
|
|
pyinotify: requires pyinotify (a
|
|
file alteration monitor) to be installed.
|
|
If pyinotify is not installed,
|
|
Fail2ban will use auto.
|
|
gamin: requires Gamin (a file alteration monitor)
|
|
to be installed.
|
|
If Gamin is not installed, Fail2ban will use
|
|
auto.
|
|
polling: uses a polling algorithm which does not require external
|
|
libraries.
|
|
systemd: uses systemd python library to access the systemd
|
|
journal.
|
|
Specifying "logpath" is not valid for this backend.
|
|
|
|
See "journalmatch" in the jails associated filter config
|
|
auto:
|
|
will try to use the following backends, in order:
|
|
pyinotify, gamin,
|
|
polling.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_usedns</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'warn'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>specifies if jails should trust hostnames in logs,
|
|
warn when DNS lookups
|
|
are performed, or ignore all hostnames in logs
|
|
yes: if a hostname is
|
|
encountered, a DNS lookup will be performed.
|
|
warn: if a hostname is
|
|
encountered, a DNS lookup will be performed,
|
|
but it will be logged as a
|
|
warning.
|
|
no: if a hostname is encountered, will not be used for banning,
|
|
|
|
but it will be logged as info.
|
|
raw: use raw value (no hostname), allow use
|
|
it for no-host filters/actions
|
|
(example user)</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_logencoding</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'auto'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>specifies the encoding of the log files
|
|
handled by the jail This is used to
|
|
decode the lines from the log file.
|
|
Typical examples: "ascii",
|
|
"utf-8"
|
|
auto: will use the system locale setting</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_enabled</span>
|
|
|
|
|
|
<span class='type'>(<tt>boolean</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>false</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>enables the jails.
|
|
By default all jails are disabled, and it should stay
|
|
this way.
|
|
Enable only relevant to your setup jails in your .local or
|
|
jail.d/*.conf
|
|
true: jail will be enabled and log files will get monitored
|
|
for changes
|
|
false: jail is not enabled</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_filter</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'%(__name__)s'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>defines the filter to use by the jail.
|
|
By default jails have names matching
|
|
their filter name</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_destemail</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'root@localhost'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Destination email address used solely for the
|
|
interpolations in
|
|
jail.conf,local,d/* configuration files.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_sender</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>"fail2ban@${::fqdn}"</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Sender email address used solely for some actions</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_mta</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'sendmail'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>E-mail action. Since 0.8.1 Fail2Ban uses sendmail MTA
|
|
for the mailing.
|
|
Change mta configuration parameter to mail if you want to
|
|
revert to
|
|
conventional 'mail'.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_protocol</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'tcp'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Default protocol.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_chain</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'INPUT'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Specify chain where jumps would need to be added in
|
|
iptables-* actions.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_port</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'0:65535'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<h1 id="label-Ports+to+be+banned+Usually+should+be+overridden">Ports to be banned Usually should be overridden</h1>
|
|
|
|
<p>in a particular jail</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_fail2ban_agent</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'Fail2Ban/%(fail2ban_version)s'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Format of user-agent
|
|
<a
|
|
href="https://tools.ietf.org/html/rfc7231#section-5.5.3">tools.ietf.org/html/rfc7231#section-5.5.3</a></p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_banaction</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'iptables-multiport'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Default banning action</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_banaction_allports</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'iptables-allports'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Default banning action</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>ban only</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_mw</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
%(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>ban & send an e-mail with whois report to the
|
|
destemail.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_mwl</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
%(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>ban & send an e-mail with whois report and
|
|
relevant log lines</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_xarf</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>ban & send a xarf e-mail to abuse contact of
|
|
IP address and include
|
|
relevant log lines.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_cf_mwl</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
|
|
%(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>ban IP on CloudFlare & send an e-mail with
|
|
whois report and relevant
|
|
log lines.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_blocklist_de</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Report block via blocklist.de fail2ban
|
|
reporting service API</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_badips_report</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<h1 id="label-Report+ban+via+badips.com">Report ban via badips.com</h1>
|
|
|
|
<p>(uses action.d/badips.conf for reporting only).</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_default_action</span>
|
|
|
|
|
|
<span class='type'>(<tt>string</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'action_'</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Choose default action.</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>fn_action_badips</span>
|
|
|
|
|
|
<span class='type'>(<tt>Any</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>'badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]'</tt>)</em>
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
|
|
</div><div class="method_details_list">
|
|
<table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
121
|
|
122
|
|
123
|
|
124
|
|
125
|
|
126
|
|
127
|
|
128
|
|
129
|
|
130
|
|
131
|
|
132
|
|
133
|
|
134
|
|
135
|
|
136
|
|
137
|
|
138
|
|
139
|
|
140
|
|
141
|
|
142
|
|
143
|
|
144
|
|
145
|
|
146
|
|
147
|
|
148
|
|
149
|
|
150
|
|
151
|
|
152
|
|
153
|
|
154
|
|
155
|
|
156
|
|
157
|
|
158
|
|
159
|
|
160
|
|
161
|
|
162
|
|
163
|
|
164
|
|
165
|
|
166
|
|
167
|
|
168
|
|
169
|
|
170
|
|
171
|
|
172
|
|
173
|
|
174
|
|
175
|
|
176
|
|
177
|
|
178
|
|
179
|
|
180
|
|
181
|
|
182
|
|
183
|
|
184
|
|
185
|
|
186
|
|
187
|
|
188
|
|
189
|
|
190
|
|
191
|
|
192
|
|
193
|
|
194
|
|
195
|
|
196
|
|
197
|
|
198
|
|
199
|
|
200
|
|
201
|
|
202
|
|
203
|
|
204
|
|
205
|
|
206
|
|
207
|
|
208
|
|
209
|
|
210
|
|
211
|
|
212
|
|
213
|
|
214
|
|
215
|
|
216
|
|
217</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'manifests/params.pp', line 121</span>
|
|
|
|
class cd_fail2ban::params (
|
|
|
|
$pkg_ensure = 'latest',
|
|
|
|
$fn_manage_config = true,
|
|
$fn_enable_service = 'running',
|
|
|
|
# fail2ban.conf/local
|
|
|
|
$fn_loglevel = 'INFO',
|
|
$fn_logtarget = 'SYSLOG',
|
|
$fn_syslogsocket = 'auto',
|
|
$fn_socket = '/var/run/fail2ban/fail2ban.sock',
|
|
$fn_pidfile = '/var/run/fail2ban/fail2ban.pid',
|
|
$fn_dbfile = '/var/lib/fail2ban/fail2ban.sqlite3',
|
|
$fn_dbpurgeage = '86400',
|
|
|
|
# jail.conf/local
|
|
$fn_ignoreip = '127.0.0.1/8',
|
|
$fn_ignorecommand = '',
|
|
$fn_bantime = '600',
|
|
$fn_findtime = '600',
|
|
$fn_maxretry = '5',
|
|
$fn_backend = 'auto',
|
|
$fn_usedns = 'warn',
|
|
$fn_logencoding = 'auto',
|
|
$fn_enabled = false,
|
|
$fn_filter = '%(__name__)s',
|
|
$fn_destemail = 'root@localhost',
|
|
$fn_sender = "fail2ban@${::fqdn}",
|
|
$fn_mta = 'sendmail',
|
|
$fn_protocol = 'tcp',
|
|
$fn_chain = 'INPUT',
|
|
$fn_port = '0:65535',
|
|
$fn_fail2ban_agent = 'Fail2Ban/%(fail2ban_version)s',
|
|
$fn_banaction = 'iptables-multiport',
|
|
$fn_banaction_allports = 'iptables-allports',
|
|
$fn_action_ = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]',
|
|
$fn_action_mw = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
%(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]',
|
|
$fn_action_mwl = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
%(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
|
|
$fn_action_xarf = '%(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
|
|
xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]',
|
|
$fn_action_cf_mwl = 'cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
|
|
%(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]',
|
|
$fn_action_blocklist_de = 'blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]',
|
|
$fn_action_badips = 'badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]',
|
|
$fn_action_badips_report = 'badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]',
|
|
$fn_default_action = 'action_',
|
|
|
|
|
|
) {
|
|
|
|
# installation section
|
|
$reqpackages = $::operatingsystem ? {
|
|
/(?i-mx:centos|fedora|redhat)/ => ['fail2ban','fail2ban-firewalld',
|
|
'fail2ban-sendmail',
|
|
'fail2ban-server.noarch','whois'],
|
|
}
|
|
|
|
$fn_jail_paths = $::operatingsystem ? {
|
|
/(?i-mx:centos|fedora|redhat)/ => 'fedora',
|
|
}
|
|
|
|
# shortcuts
|
|
$fn_os = $::operatingsystem
|
|
|
|
# service
|
|
$fn_service = 'fail2ban'
|
|
|
|
# directories
|
|
$fn_main_dir = '/etc/fail2ban'
|
|
$fn_action_d_dir = "${fn_main_dir}/action.d"
|
|
$fn_fail2ban_d_dir = "${fn_main_dir}/fail2ban.d"
|
|
$fn_filter_d_dir = "${fn_main_dir}/filter.d"
|
|
$fn_jail_d_dir = "${fn_main_dir}/jail.d"
|
|
$fn_var_lib_dir = '/var/lib/fail2ban'
|
|
$fn_var_run_dir = '/var/run/fail2ban'
|
|
|
|
# files
|
|
$fn_fail2ban_conf_file = "${fn_main_dir}/fail2ban.conf"
|
|
$fn_fail2ban_conf_erb = 'cd_fail2ban/fail2ban_conf.erb'
|
|
$fn_fail2ban_local_file = "${fn_main_dir}/fail2ban.local"
|
|
$fn_fail2ban_local_erb = 'cd_fail2ban/fail2ban_local.erb'
|
|
$fn_jail_conf_file = "${fn_main_dir}/jail.conf"
|
|
$fn_jail_conf_erb = 'cd_fail2ban/jail_conf.erb'
|
|
$fn_jail_local_file = "${fn_main_dir}/jail.local"
|
|
$fn_jail_local_erb = 'cd_fail2ban/jail_local.erb'
|
|
$fn_paths_common_file = "${fn_main_dir}/paths-common.conf"
|
|
$fn_paths_common_erb = 'cd_fail2ban/paths_common_conf.erb'
|
|
|
|
# includes must be last
|
|
|
|
include cd_fail2ban::main::config
|
|
|
|
}</pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
</div>
|
|
|
|
<div id="footer">
|
|
Generated on Mon Oct 9 17:39:08 2017 by
|
|
<a href="http://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|
0.9.9 (ruby-2.0.0).
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |