Initial commit

templates/concat/jail.local-footer.erb

@@ -0,0 +1 @@
+### jails footer - File managed by Puppet ###

templates/concat/jail.local-header.erb

@@ -0,0 +1,45 @@
+[DEFAULT]
+<% if scope.lookupvar("fail2ban::ignoreip") != '' -%>
+ignoreip = <%= scope.lookupvar("fail2ban::ignoreip") * ' ' %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::bantime") != '' -%>
+bantime  = <%= scope.lookupvar("fail2ban::bantime") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::findtime") != '' -%>
+findtime = <%= scope.lookupvar("fail2ban::findtime") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::maxretry") != '' -%>
+maxretry = <%= scope.lookupvar("fail2ban::maxretry") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::backend") != '' -%>
+backend = <%= scope.lookupvar("fail2ban::backend") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::mailto") != '' -%>
+destemail = <%= scope.lookupvar("fail2ban::mailto") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::banaction") != '' -%>
+banaction = <%= scope.lookupvar("fail2ban::banaction") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::mta") != '' -%>
+mta = <%= scope.lookupvar("fail2ban::mta") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::jails_protocol") != '' -%>
+protocol = <%= scope.lookupvar("fail2ban::jails_protocol") %>
+<% end -%>
+<% if scope.lookupvar("fail2ban::jails_chain") != '' -%>
+chain = <%= scope.lookupvar("fail2ban::jails_chain") %>
+<% end -%>
+
+### Default action ###
+## The simplest action to take: ban only
+action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+## ban & send an e-mail with whois report and relevant log lines
+## to the destemail.
+action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+             %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
+
+# Choose default action.  To change, just override value of 'action' with the
+# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
+# globally (section [DEFAULT]) or per specific section
+action = %(action_mwl)s

templates/concat/jail.local-stanza.erb

@@ -0,0 +1,24 @@
+##################
+[<%= real_jailname %>]
+enabled  = <%= real_status %>
+<% if real_filter != '' -%>
+filter   = <%= real_filter %>
+<% end -%>
+<% if array_port != [] -%>
+port     = <%= array_port * ',' %>
+<% end -%>
+<% if array_action != [] -%>
+action   = <% array_action.each do |a| -%>
+          <%= a %>
+          <% end -%>
+<% end -%>
+<% if real_logpath != '' -%>
+logpath  = <%= real_logpath %>
+<% end -%>
+<% if real_maxretry != '' -%>
+maxretry = <%= real_maxretry %>
+<% end -%>
+<% if real_bantime != '' -%>
+bantime  = <%= real_bantime %>
+<% end -%>
+

templates/jail.local.erb

@@ -0,0 +1,55 @@
+##################
+# Puppet Managed #
+##################
+
+[DEFAULT]
+ignoreip = 127.0.0.1
+bantime  = 600
+findtime  = 600
+maxretry = 3
+backend = auto
+
+[imap-iptables]
+enabled  = <%= scope.lookupvar('fail2ban::jails').include? "imap" %>
+filter   = dovecot
+action   = iptables[name=IMAP, port=imap, protocol=tcp]
+<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
+           sendmail-whois[name=POP3, dest=<%= scope.lookupvar('fail2ban::mailto') %>, sender=fail2ban@<%= fqdn %>]
+<% end -%>
+logpath  = /var/log/maillog
+maxretry = 5
+
+[pop3-iptables]
+enabled  = <%= scope.lookupvar('fail2ban::jails').include? "pop3" %>
+filter   = mail
+action   = iptables[name=POP3, port=pop3, protocol=tcp]
+<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
+           sendmail-whois[name=POP3, dest=<%= scope.lookupvar('fail2ban::mailto') %>, sender=fail2ban@<%= fqdn %>]
+<% end -%>
+logpath  = /var/log/maillog
+maxretry = 5
+
+[ssh-iptables]
+enabled  = <%= scope.lookupvar('fail2ban::jails').include? "ssh" %>
+filter   = sshd
+action   = iptables[name=SSH, port=ssh, protocol=tcp]
+<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
+           sendmail-whois[name=SSH, dest=<%= scope.lookupvar('fail2ban::mailto') %>, sender=fail2ban@<%= fqdn %>]
+<% end -%>
+<% if operatingsystem == "Debian" -%>
+logpath  = /var/log/auth.log
+<% else -%>
+logpath  = /var/log/secure
+<% end -%>
+maxretry = 5
+
+[vsftpd-iptables]
+enabled  = <%= scope.lookupvar('fail2ban::jails').include? "vsftpd" %>
+filter   = vsftpd
+action   = iptables[name=VSFTPD, port=ftp, protocol=tcp]
+<% unless scope.lookupvar('fail2ban::mailto').empty? -%>
+           sendmail-whois[name=VSFTPD, dest=<%= scope.lookupvar('fail2ban::mailto') %>, sender=fail2ban@<%= fqdn %>]
+<% end -%>
+logpath  = /var/log/vsftpd.log
+maxretry = 5
+bantime  = 1800

templates/spec.erb

@@ -0,0 +1,8 @@
+# This is a template used only for rspec tests
+
+# Yaml of the whole scope
+<%= scope.to_hash.reject { |k,v| !( k.is_a?(String) && v.is_a?(String) ) }.to_yaml %>
+
+# Custom Options
+<%= options['opt_a'] %>
+<%= options['opt_b'] %>