From 3bcea81f8269366a4536f527299aae28c68cda40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20B=C3=A9rtoli?= Date: Mon, 29 Apr 2013 16:26:21 -0300 Subject: [PATCH] Add template to manage fail2ban.conf (see #1) Also corrected some tests and documentation --- manifests/init.pp | 44 +++++++++++++++++++++++++++-------- manifests/params.pp | 7 ++++-- spec/classes/fail2ban_spec.rb | 15 ++++++------ templates/fail2ban.conf.erb | 8 +++++++ templates/jail.local.erb | 18 +++++++------- 5 files changed, 64 insertions(+), 28 deletions(-) create mode 100644 templates/fail2ban.conf.erb diff --git a/manifests/init.pp b/manifests/init.pp index b5c7763..484fd11 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -14,7 +14,7 @@ # Can be defined also by the (top scope) variable $fail2ban_myclass # # [*source*] -# Sets the content of source parameter for main configuration file +# Sets the content of source parameter for main configuration file (fail2ban.conf) # If defined, fail2ban main config file will have the param: source => $source # Can be defined also by the (top scope) variable $fail2ban_source # @@ -79,23 +79,28 @@ # # [*jails_file*] # Path to 'jail.local' file +# Default: /etc/fail2ban/jail.local # # [*jails_config*] # Define how you want to manage jails configuration: # "file" - To provide jail.local as a normal file. If you choose this option, # set ONE of [*jails_source*] or [*jails_template*] # "concat" - To build it up using different fragments -# - This option, set as default, permits the use of the fail2ban::jail define +# - This option, (preferred), permits the use of the fail2ban::jail define +# Default: empty. Uses "jail.local" from distribution, if any. # # [*jails_source*] # Sets the content of source parameter for the jail.local configuration file -# Note that single stanzas of jail.local can be managed by fail2ban::jails # # [*jails_template*] # Sets the path to the template to use as content for the jail.local configuration file # If defined, fail2ban jails config file has: content => content("$jails_template") # Note source and template parameters are mutually exclusive: don't use both # +# [*jails*] +# When using [*jails_template*] you can have some control on what jail is enabled or not +# setting an array named "jails", containing the names of the jail you want enabled. +# # [*jails_template_header*] # Path to the template to use as header with concat # Used by fail2ban::jails @@ -112,7 +117,7 @@ # Default: INPUT # # [*options*] -# An hash of custom options to be used in templates for arbitrary settings. +# A hash of custom options to be used in templates for arbitrary settings. # Can be defined also by the (top scope) variable $fail2ban_options # # [*service_autorestart*] @@ -236,8 +241,20 @@ # [*log_dir*] # Base logs directory. Used by puppi # +# [*log_level*] +# Set the log level output. +# 1 = ERROR +# 2 = WARN +# 3 = INFO +# 4 = DEBUG +# Default: 3 +# # [*log_file*] -# Log file(s). Used by puppi +# Log file(s). Used by puppi also. +# +# [*socket*] +# Socket file used by fail2ban-client to communicate with fail2ban. +# Default: /var/run/fail2ban/fail2ban.sock # # == Examples # @@ -247,7 +264,6 @@ # # See README for details. # -# # == Author # Alessandro Franceschi # Javier Bertoli @@ -292,6 +308,8 @@ class fail2ban ( $data_dir = params_lookup( 'data_dir' ), $log_dir = params_lookup( 'log_dir' ), $log_file = params_lookup( 'log_file' ), + $log_level = params_lookup( 'log_level' ), + $socket = params_lookup( 'socket' ), $ignoreip = params_lookup( 'ignoreip' ), $bantime = params_lookup( 'bantime' ), $findtime = params_lookup( 'findtime' ), @@ -421,7 +439,16 @@ class fail2ban ( # How to manage fail2ban jail.local configuration case $fail2ban::jails_config { + 'concat': { include fail2ban::jailsconcat } 'file': { + $array_jails = is_array($fail2ban::jails) ? { + false => $fail2ban::jails ? { + '' => [], + default => [$fail2ban::jails], + }, + default => $fail2ban::jails, + } + $manage_file_jails_source = $fail2ban::jails_source ? { '' => undef, default => $fail2ban::jails_source, @@ -431,7 +458,7 @@ class fail2ban ( '' => undef, default => template($fail2ban::jails_template), } - + file { 'jail.local': ensure => $fail2ban::manage_file, path => $fail2ban::jails_file, @@ -446,9 +473,6 @@ class fail2ban ( audit => $fail2ban::manage_audit, noop => $fail2ban::bool_noops, } - } - 'concat': { include fail2ban::jailsconcat - } default: { } } diff --git a/manifests/params.pp b/manifests/params.pp index dc426a3..deb520b 100644 --- a/manifests/params.pp +++ b/manifests/params.pp @@ -103,6 +103,9 @@ class fail2ban::params { default => '/var/log/fail2ban/fail2ban.log', } + $log_level = '3' + $socket = '/var/run/fail2ban/fail2ban.sock' + $ignoreip = ['127.0.0.1/8'] $bantime = '600' $findtime = '600' @@ -114,7 +117,7 @@ class fail2ban::params { $jails_protocol = 'tcp' $jails_chain = 'INPUT' - $jails = [] + $jails = '' $jails_source = '' $jails_template = '' $jails_template_header = 'fail2ban/concat/jail.local-header.erb' @@ -123,9 +126,9 @@ class fail2ban::params { # General Settings $my_class = '' $source = '' + $template = '' $source_dir = '' $source_dir_purge = false - $template = '' $options = '' $service_autorestart = true $version = 'present' diff --git a/spec/classes/fail2ban_spec.rb b/spec/classes/fail2ban_spec.rb index 01be081..a830664 100644 --- a/spec/classes/fail2ban_spec.rb +++ b/spec/classes/fail2ban_spec.rb @@ -25,19 +25,20 @@ describe 'fail2ban' do end describe 'Test jails managed throuh file - template' do + let(:facts) { {:operatingsystem => 'Debian' } } + let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/jail.local.erb', :jails => 'ssh' } } + it { should contain_file('jail.local').without_source } + it { should contain_file('jail.local').with_content(/"*ssh-iptables] +enabled = true*/) } + end + + describe 'Test jails managed throuh file - custom template' do let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/spec.erb', :options => { 'opt_a' => 'value_a' } } } it { should contain_file('jail.local').with_content(/fqdn: rspec.example42.com/) } it { should contain_file('jail.local').without_source } it { should contain_file('jail.local').with_content(/value_a/) } end -# describe 'Test jails managed throuh concat' do -# let(:params) { {:jails_config => 'concat' } } -# it { should include_class('fail2ban::jailsconcat') } -# it { should contain_fail2ban__jailsconcat() } -# -# end - describe 'Test installation of a specific version' do let(:params) { {:version => '1.0.42' } } it { should contain_package('fail2ban').with_ensure('1.0.42') } diff --git a/templates/fail2ban.conf.erb b/templates/fail2ban.conf.erb new file mode 100644 index 0000000..2dc6906 --- /dev/null +++ b/templates/fail2ban.conf.erb @@ -0,0 +1,8 @@ +# This file is managed by Puppet. DO NOT EDIT. +# +[Definition] +loglevel = <%= scope.lookupvar('fail2ban::log_level') %> + +logtarget = <%= scope.lookupvar('fail2ban::log_file') %> + +socket = <%= scope.lookupvar('fail2ban::socket') %> diff --git a/templates/jail.local.erb b/templates/jail.local.erb index 30f5a6e..2f58785 100644 --- a/templates/jail.local.erb +++ b/templates/jail.local.erb @@ -1,13 +1,13 @@ # This file is managed by Puppet. DO NOT EDIT. [DEFAULT] -ignoreip = 127.0.0.1 -bantime = 600 -findtime = 600 -maxretry = 3 -backend = auto +ignoreip = <%= scope.lookupvar('fail2ban::ignoreip') %> +bantime = <%= scope.lookupvar('fail2ban::bantime') %> +findtime = <%= scope.lookupvar('fail2ban::findtime') %> +maxretry = <%= scope.lookupvar('fail2ban::maxretry') %> +backend = <%= scope.lookupvar('fail2ban::backend') %> [imap-iptables] -enabled = <%= scope.lookupvar('fail2ban::jails').include? "imap" %> +enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "imap" %> filter = dovecot action = iptables[name=IMAP, port=imap, protocol=tcp] <% unless scope.lookupvar('fail2ban::mailto').empty? -%> @@ -17,7 +17,7 @@ logpath = /var/log/maillog maxretry = 5 [pop3-iptables] -enabled = <%= scope.lookupvar('fail2ban::jails').include? "pop3" %> +enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "pop3" %> filter = mail action = iptables[name=POP3, port=pop3, protocol=tcp] <% unless scope.lookupvar('fail2ban::mailto').empty? -%> @@ -27,7 +27,7 @@ logpath = /var/log/maillog maxretry = 5 [ssh-iptables] -enabled = <%= scope.lookupvar('fail2ban::jails').include? "ssh" %> +enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "ssh" %> filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] <% unless scope.lookupvar('fail2ban::mailto').empty? -%> @@ -41,7 +41,7 @@ logpath = /var/log/secure maxretry = 5 [vsftpd-iptables] -enabled = <%= scope.lookupvar('fail2ban::jails').include? "vsftpd" %> +enabled = <%= scope.lookupvar('fail2ban::array_jails').include? "vsftpd" %> filter = vsftpd action = iptables[name=VSFTPD, port=ftp, protocol=tcp] <% unless scope.lookupvar('fail2ban::mailto').empty? -%>