dinislage/puppet-fail2ban
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add template to manage fail2ban.conf (see #1)

Browse Source 
Also corrected some tests and documentation
This commit is contained in:
Javier Bértoli
2013-04-29 16:26:21 -03:00
parent d213d8408c
commit 3bcea81f82
5 changed files with 64 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/init.pp
+34 -10
View File
@@ -14,7 +14,7 @@
# Can be defined also by the (top scope) variable $fail2ban_myclass
#
# [*source*]
# Sets the content of source parameter for main configuration file
# Sets the content of source parameter for main configuration file (fail2ban.conf)
# If defined, fail2ban main config file will have the param: source => $source
# Can be defined also by the (top scope) variable $fail2ban_source
#
@@ -79,23 +79,28 @@
#
# [*jails_file*]
# Path to 'jail.local' file
# Default: /etc/fail2ban/jail.local
#
# [*jails_config*]
# Define how you want to manage jails configuration:
# "file" - To provide jail.local as a normal file. If you choose this option,
# set ONE of [*jails_source*] or [*jails_template*]
# "concat" - To build it up using different fragments
# - This option, set as default, permits the use of the fail2ban::jail define
# - This option, (preferred), permits the use of the fail2ban::jail define
# Default: empty. Uses "jail.local" from distribution, if any.
#
# [*jails_source*]
# Sets the content of source parameter for the jail.local configuration file
# Note that single stanzas of jail.local can be managed by fail2ban::jails
#
# [*jails_template*]
# Sets the path to the template to use as content for the jail.local configuration file
# If defined, fail2ban jails config file has: content => content("$jails_template")
# Note source and template parameters are mutually exclusive: don't use both
#
# [*jails*]
# When using [*jails_template*] you can have some control on what jail is enabled or not
# setting an array named "jails", containing the names of the jail you want enabled.
#
# [*jails_template_header*]
# Path to the template to use as header with concat
# Used by fail2ban::jails
@@ -112,7 +117,7 @@
# Default: INPUT
#
# [*options*]
# An hash of custom options to be used in templates for arbitrary settings.
# A hash of custom options to be used in templates for arbitrary settings.
# Can be defined also by the (top scope) variable $fail2ban_options
#
# [*service_autorestart*]
@@ -236,8 +241,20 @@
# [*log_dir*]
# Base logs directory. Used by puppi
#
# [*log_level*]
# Set the log level output.
# 1 = ERROR
# 2 = WARN
# 3 = INFO
# 4 = DEBUG
# Default: 3
#
# [*log_file*]
# Log file(s). Used by puppi
# Log file(s). Used by puppi also.
#
# [*socket*]
# Socket file used by fail2ban-client to communicate with fail2ban.
# Default: /var/run/fail2ban/fail2ban.sock
#
# == Examples
#
@@ -247,7 +264,6 @@
#
# See README for details.
#
#
# == Author
# Alessandro Franceschi <al@lab42.it/>
# Javier Bertoli <javier@netmanagers.com.ar/>
@@ -292,6 +308,8 @@ class fail2ban (
$data_dir = params_lookup( 'data_dir' ),
$log_dir = params_lookup( 'log_dir' ),
$log_file = params_lookup( 'log_file' ),
$log_level = params_lookup( 'log_level' ),
$socket = params_lookup( 'socket' ),
$ignoreip = params_lookup( 'ignoreip' ),
$bantime = params_lookup( 'bantime' ),
$findtime = params_lookup( 'findtime' ),
@@ -421,7 +439,16 @@ class fail2ban (
# How to manage fail2ban jail.local configuration
case $fail2ban::jails_config {
'concat': { include fail2ban::jailsconcat }
'file': {
$array_jails = is_array($fail2ban::jails) ? {
false => $fail2ban::jails ? {
'' => [],
default => [$fail2ban::jails],
},
default => $fail2ban::jails,
}
$manage_file_jails_source = $fail2ban::jails_source ? {
'' => undef,
default => $fail2ban::jails_source,
@@ -431,7 +458,7 @@ class fail2ban (
'' => undef,
default => template($fail2ban::jails_template),
}
file { 'jail.local':
ensure => $fail2ban::manage_file,
path => $fail2ban::jails_file,
@@ -446,9 +473,6 @@ class fail2ban (
audit => $fail2ban::manage_audit,
noop => $fail2ban::bool_noops,
}
}
'concat': { include fail2ban::jailsconcat
}
default: { }
}
manifests/params.pp
+5 -2
View File
@@ -103,6 +103,9 @@ class fail2ban::params {
default => '/var/log/fail2ban/fail2ban.log',
}
$log_level = '3'
$socket = '/var/run/fail2ban/fail2ban.sock'
$ignoreip = ['127.0.0.1/8']
$bantime = '600'
$findtime = '600'
@@ -114,7 +117,7 @@ class fail2ban::params {
$jails_protocol = 'tcp'
$jails_chain = 'INPUT'
$jails = []
$jails = ''
$jails_source = ''
$jails_template = ''
$jails_template_header = 'fail2ban/concat/jail.local-header.erb'
@@ -123,9 +126,9 @@ class fail2ban::params {
# General Settings
$my_class = ''
$source = ''
$template = ''
$source_dir = ''
$source_dir_purge = false
$template = ''
$options = ''
$service_autorestart = true
$version = 'present'
spec/classes/fail2ban_spec.rb
+8 -7
View File
@@ -25,19 +25,20 @@ describe 'fail2ban' do
end
describe 'Test jails managed throuh file - template' do
let(:facts) { {:operatingsystem => 'Debian' } }
let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/jail.local.erb', :jails => 'ssh' } }
it { should contain_file('jail.local').without_source }
it { should contain_file('jail.local').with_content(/"*ssh-iptables]
enabled = true*/) }
end
describe 'Test jails managed throuh file - custom template' do
let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/spec.erb', :options => { 'opt_a' => 'value_a' } } }
it { should contain_file('jail.local').with_content(/fqdn: rspec.example42.com/) }
it { should contain_file('jail.local').without_source }
it { should contain_file('jail.local').with_content(/value_a/) }
end
# describe 'Test jails managed throuh concat' do
# let(:params) { {:jails_config => 'concat' } }
# it { should include_class('fail2ban::jailsconcat') }
# it { should contain_fail2ban__jailsconcat() }
#
# end
describe 'Test installation of a specific version' do
let(:params) { {:version => '1.0.42' } }
it { should contain_package('fail2ban').with_ensure('1.0.42') }
templates/fail2ban.conf.erb
+8
View File
@@ -0,0 +1,8 @@
# This file is managed by Puppet. DO NOT EDIT.
#
[Definition]
loglevel = <%= scope.lookupvar('fail2ban::log_level') %>
logtarget = <%= scope.lookupvar('fail2ban::log_file') %>
socket = <%= scope.lookupvar('fail2ban::socket') %>
templates/jail.local.erb
+9 -9
View File
@@ -1,13 +1,13 @@
# This file is managed by Puppet. DO NOT EDIT.
[DEFAULT]
ignoreip = 127.0.0.1
bantime = 600
findtime = 600
maxretry = 3
backend = auto
ignoreip = <%= scope.lookupvar('fail2ban::ignoreip') %>
bantime = <%= scope.lookupvar('fail2ban::bantime') %>
findtime = <%= scope.lookupvar('fail2ban::findtime') %>
maxretry = <%= scope.lookupvar('fail2ban::maxretry') %>
backend = <%= scope.lookupvar('fail2ban::backend') %>
[imap-iptables]
enabled = <%= scope.lookupvar('fail2ban::jails').include? "imap" %>
enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "imap" %>
filter = dovecot
action = iptables[name=IMAP, port=imap, protocol=tcp]
<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -17,7 +17,7 @@ logpath = /var/log/maillog
maxretry = 5
[pop3-iptables]
enabled = <%= scope.lookupvar('fail2ban::jails').include? "pop3" %>
enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "pop3" %>
filter = mail
action = iptables[name=POP3, port=pop3, protocol=tcp]
<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -27,7 +27,7 @@ logpath = /var/log/maillog
maxretry = 5
[ssh-iptables]
enabled = <%= scope.lookupvar('fail2ban::jails').include? "ssh" %>
enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "ssh" %>
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -41,7 +41,7 @@ logpath = /var/log/secure
maxretry = 5
[vsftpd-iptables]
enabled = <%= scope.lookupvar('fail2ban::jails').include? "vsftpd" %>
enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "vsftpd" %>
filter = vsftpd
action = iptables[name=VSFTPD, port=ftp, protocol=tcp]
<% unless scope.lookupvar('fail2ban::mailto').empty? -%>