Add template to manage fail2ban.conf (see #1)

Also corrected some tests and documentation

manifests/init.pp

@@ -14,7 +14,7 @@
 #   Can be defined also by the (top scope) variable $fail2ban_myclass
 #
 # [*source*]
-#   Sets the content of source parameter for main configuration file
+#   Sets the content of source parameter for main configuration file (fail2ban.conf)
 #   If defined, fail2ban main config file will have the param: source => $source
 #   Can be defined also by the (top scope) variable $fail2ban_source
 #
@@ -79,23 +79,28 @@
 #
 # [*jails_file*]
 #   Path to 'jail.local' file
+#   Default: /etc/fail2ban/jail.local
 #
 # [*jails_config*]
 #   Define how you want to manage jails configuration:
 #    "file"   - To provide jail.local as a normal file. If you choose this option, 
 #               set ONE of [*jails_source*] or [*jails_template*]
 #    "concat" - To build it up using different fragments
-#             - This option, set as default, permits the use of the fail2ban::jail define
+#             - This option, (preferred), permits the use of the fail2ban::jail define
+#   Default: empty. Uses "jail.local" from distribution, if any.
 #
 # [*jails_source*]
 #   Sets the content of source parameter for the jail.local configuration file
-#   Note that single stanzas of jail.local can be managed by fail2ban::jails
 #
 # [*jails_template*]
 #   Sets the path to the template to use as content for the jail.local configuration file
 #   If defined, fail2ban jails config file has: content => content("$jails_template")
 #   Note source and template parameters are mutually exclusive: don't use both
 #
+# [*jails*]
+#   When using [*jails_template*] you can have some control on what jail is enabled or not
+#   setting an array named "jails", containing the names of the jail you want enabled.
+#
 # [*jails_template_header*]
 #   Path to the template to use as header with concat
 #   Used by fail2ban::jails
@@ -112,7 +117,7 @@
 #   Default: INPUT
 #
 # [*options*]
-#   An hash of custom options to be used in templates for arbitrary settings.
+#   A hash of custom options to be used in templates for arbitrary settings.
 #   Can be defined also by the (top scope) variable $fail2ban_options
 #
 # [*service_autorestart*]
@@ -236,8 +241,20 @@
 # [*log_dir*]
 #   Base logs directory. Used by puppi
 #
+# [*log_level*]
+#   Set the log level output.
+#          1 = ERROR
+#          2 = WARN
+#          3 = INFO
+#          4 = DEBUG
+#   Default:  3
+#
 # [*log_file*]
-#   Log file(s). Used by puppi
+#   Log file(s). Used by puppi also.
+#
+# [*socket*]
+#   Socket file used by fail2ban-client to communicate with fail2ban.
+#   Default: /var/run/fail2ban/fail2ban.sock
 #
 # == Examples
 #
@@ -247,7 +264,6 @@
 #
 # See README for details.
 #
-#
 # == Author
 #   Alessandro Franceschi <al@lab42.it/>
 #   Javier Bertoli <javier@netmanagers.com.ar/>
@@ -292,6 +308,8 @@ class fail2ban (
   $data_dir              = params_lookup( 'data_dir' ),
   $log_dir               = params_lookup( 'log_dir' ),
   $log_file              = params_lookup( 'log_file' ),
+  $log_level             = params_lookup( 'log_level' ),
+  $socket                = params_lookup( 'socket' ),
   $ignoreip              = params_lookup( 'ignoreip' ),
   $bantime               = params_lookup( 'bantime' ),
   $findtime              = params_lookup( 'findtime' ),
@@ -421,7 +439,16 @@ class fail2ban (
 
   # How to manage fail2ban jail.local configuration
   case $fail2ban::jails_config {
+    'concat': { include fail2ban::jailsconcat }
     'file': {
+      $array_jails = is_array($fail2ban::jails) ? {
+        false     => $fail2ban::jails ? {
+          ''      => [],
+          default => [$fail2ban::jails],
+        },
+        default   => $fail2ban::jails,
+      }
+
       $manage_file_jails_source = $fail2ban::jails_source ? {
         ''        => undef,
         default   => $fail2ban::jails_source,
@@ -431,7 +458,7 @@ class fail2ban (
         ''        => undef,
         default   => template($fail2ban::jails_template),
       }
-    
+   
       file { 'jail.local':
         ensure  => $fail2ban::manage_file,
         path    => $fail2ban::jails_file,
@@ -446,9 +473,6 @@ class fail2ban (
         audit   => $fail2ban::manage_audit,
         noop    => $fail2ban::bool_noops,
       }
-    }
-    'concat': { include fail2ban::jailsconcat 
-    
     }
     default: { }
   }

manifests/params.pp

@@ -103,6 +103,9 @@ class fail2ban::params {
     default => '/var/log/fail2ban/fail2ban.log',
   }
 
+  $log_level = '3'
+  $socket    = '/var/run/fail2ban/fail2ban.sock'
+
   $ignoreip  = ['127.0.0.1/8']
   $bantime   = '600'
   $findtime  = '600'
@@ -114,7 +117,7 @@ class fail2ban::params {
   $jails_protocol  = 'tcp'
   $jails_chain     = 'INPUT'
 
-  $jails = []
+  $jails = ''
   $jails_source = ''
   $jails_template = ''
   $jails_template_header = 'fail2ban/concat/jail.local-header.erb'
@@ -123,9 +126,9 @@ class fail2ban::params {
   # General Settings
   $my_class = ''
   $source = ''
+  $template = ''
   $source_dir = ''
   $source_dir_purge = false
-  $template = ''
   $options = ''
   $service_autorestart = true
   $version = 'present'

spec/classes/fail2ban_spec.rb

@@ -25,19 +25,20 @@ describe 'fail2ban' do
   end
 
   describe 'Test jails managed throuh file - template' do
+    let(:facts) { {:operatingsystem => 'Debian' } }
+    let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/jail.local.erb', :jails => 'ssh' } }
+    it { should contain_file('jail.local').without_source }
+    it { should contain_file('jail.local').with_content(/"*ssh-iptables]
+enabled  = true*/) }
+  end
+
+  describe 'Test jails managed throuh file - custom template' do
     let(:params) { {:jails_config => 'file', :jails_template => 'fail2ban/spec.erb', :options => { 'opt_a' => 'value_a' } } }
     it { should contain_file('jail.local').with_content(/fqdn: rspec.example42.com/) }
     it { should contain_file('jail.local').without_source }
     it { should contain_file('jail.local').with_content(/value_a/) }
   end
 
-#  describe 'Test jails managed throuh concat' do
-#    let(:params) { {:jails_config => 'concat' } }
-#    it { should include_class('fail2ban::jailsconcat') }
-#    it { should contain_fail2ban__jailsconcat() }
-#
-#  end
-
   describe 'Test installation of a specific version' do
     let(:params) { {:version => '1.0.42' } }
     it { should contain_package('fail2ban').with_ensure('1.0.42') }

templates/fail2ban.conf.erb

@@ -0,0 +1,8 @@
+# This file is managed by Puppet. DO NOT EDIT.
+#
+[Definition]
+loglevel = <%= scope.lookupvar('fail2ban::log_level') %>
+
+logtarget = <%= scope.lookupvar('fail2ban::log_file') %>
+
+socket = <%= scope.lookupvar('fail2ban::socket') %>

templates/jail.local.erb

@@ -1,13 +1,13 @@
 # This file is managed by Puppet. DO NOT EDIT.
 [DEFAULT]
-ignoreip = 127.0.0.1
+ignoreip = <%= scope.lookupvar('fail2ban::ignoreip') %>
-bantime  = 600
+bantime  = <%= scope.lookupvar('fail2ban::bantime') %>
-findtime  = 600
+findtime = <%= scope.lookupvar('fail2ban::findtime') %>
-maxretry = 3
+maxretry = <%= scope.lookupvar('fail2ban::maxretry') %>
-backend = auto
+backend  = <%= scope.lookupvar('fail2ban::backend') %>
 
 [imap-iptables]
-enabled  = <%= scope.lookupvar('fail2ban::jails').include? "imap" %>
+enabled  = <%= scope.lookupvar('fail2ban::array_jails').include? "imap" %>
 filter   = dovecot
 action   = iptables[name=IMAP, port=imap, protocol=tcp]
 <% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -17,7 +17,7 @@ logpath  = /var/log/maillog
 maxretry = 5
 
 [pop3-iptables]
-enabled  = <%= scope.lookupvar('fail2ban::jails').include? "pop3" %>
+enabled  = <%= scope.lookupvar('fail2ban::array_jails').include? "pop3" %>
 filter   = mail
 action   = iptables[name=POP3, port=pop3, protocol=tcp]
 <% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -27,7 +27,7 @@ logpath  = /var/log/maillog
 maxretry = 5
 
 [ssh-iptables]
-enabled  = <%= scope.lookupvar('fail2ban::jails').include? "ssh" %>
+enabled  = <%= scope.lookupvar('fail2ban::array_jails').include? "ssh" %>
 filter   = sshd
 action   = iptables[name=SSH, port=ssh, protocol=tcp]
 <% unless scope.lookupvar('fail2ban::mailto').empty? -%>
@@ -41,7 +41,7 @@ logpath  = /var/log/secure
 maxretry = 5
 
 [vsftpd-iptables]
-enabled  = <%= scope.lookupvar('fail2ban::jails').include? "vsftpd" %>
+enabled  = <%= scope.lookupvar('fail2ban::array_jails').include? "vsftpd" %>
 filter   = vsftpd
 action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
 <% unless scope.lookupvar('fail2ban::mailto').empty? -%>