Add a define to manage actions in fail2ban

It creates a .local action file with user defined ban/unban actions, using a template or a source file
2013-08-08 19:23:46 -03:00
parent 3e015d6635
commit e14a8aeea7
3 changed files with 275 additions and 0 deletions
@@ -0,0 +1,151 @@
+# Define: fail2ban::action
+#
+# Adds a custom fail2ban action
+# Documentation: Manpages & http://www.fail2ban.org/wiki/index.php/MANUAL_0_8
+#
+# Supported arguments:
+# $actionname - The name you want to give the action.
+#               If not set, defaults to == default
+#               action local file is named after this value, like
+#               $name.local. The suffix "local" is automatically added.
+#
+# $enable     - true / false. If false, the rule _IS NOT ADDED_ to the
+#               action.local file
+#               Defaults to true
+#
+# $source     - Sets the content of source parameter for the new action
+#               It's mutually exclusive with $template.
+#
+# $template   - Template to use when defining a new action
+#               It's mutually exclusive with $source.
+#
+# $start      - command(s) executed when the jail starts.
+#               Can be an array
+#               Used only with $template
+#
+# $stop       - command(s) executed when the jail stops.
+#               Can be an array
+#               Used only with $template
+#
+# $check      - the command ran before any other action.
+#               It aims to verify if the environment is still ok.
+#               Used only with $template
+#
+# $ban        - command(s) that bans the IP address after maxretry
+#               log lines matches within last findtime seconds.
+#               Used only with $template
+#
+# $unban      - command(s) that unbans the IP address after bantime.
+#               Used only with $template
+#
+# $actionbefore - indicates an action file that is read before the
+#                 [Definition] section.
+#
+# $actionafter  - indicates an action file is read after the
+#                 [Definition] section.
+#
+# $initvars   - Variables for the INIT stanza of the action file.
+#               They are tuples in the format
+#                  "var = value"
+#               Can be an array like
+#               [ "var1 = value1", "var2 = value2",.., "varN = valueN" ]
+#
+define fail2ban::action (
+  $actionname     = '',
+  $actionsource   = '',
+  $actiontemplate = 'fail2ban/action.local.erb',
+  $actionstart    = '',
+  $actionstop     = '',
+  $actioncheck    = '',
+  $actionban      = '',
+  $actionunban    = '',
+  $actionbefore   = '',
+  $actionafter    = '',
+  $actioninitvars = '',
+  $enable   = true ) {
+
+  include fail2ban
+
+  $real_actionname = $actionname ? {
+    ''      => $title,
+    default => $actionname,
+  }
+
+  $action_file = "${fail2ban::data_dir}/action.d/${real_actionname}.local"
+
+  $array_start = is_array($actionstart) ? {
+    false     => $actionstart ? {
+      ''      => ['/bin/true'],
+      default => [$actionstart],
+    },
+    default   => $actionstart,
+  }
+
+  $array_stop = is_array($actionstop) ? {
+    false     => $actionstop? {
+      ''      => ['/bin/true'],
+      default => [$actionstop],
+    },
+    default   => $actionstop,
+  }
+
+  $array_check = is_array($actioncheck) ? {
+    false     => $actioncheck? {
+      ''      => ['/bin/true'],
+      default => [$actioncheck],
+    },
+    default   => $actioncheck,
+  }
+
+  $array_ban = is_array($actionban) ? {
+    false     => $actionban? {
+      ''      => ['/bin/true'],
+      default => [$actionban],
+    },
+    default   => $actionban,
+  }
+
+  $array_unban = is_array($actionunban) ? {
+    false     => $actionunban? {
+      ''      => ['/bin/true'],
+      default => [$actionunban],
+    },
+    default   => $actionunban,
+  }
+
+  $array_initvars = is_array($actioninitvars) ? {
+    false     => $actioninitvars? {
+      ''      => [],
+      default => [$actioninitvars],
+    },
+    default   => $actioninitvars,
+  }
+
+  $ensure = bool2ensure($enable)
+
+  $manage_file_source = $actionsource ? {
+    ''        => undef,
+    default   => $actionsource,
+  }
+
+  $manage_file_content = $actiontemplate ? {
+    ''        => undef,
+    default   => template($actiontemplate),
+  }
+
+  file { "${real_actionname}.local":
+    ensure  => $fail2ban::manage_file,
+    path    => $action_file,
+    mode    => $fail2ban::config_file_mode,
+    owner   => $fail2ban::config_file_owner,
+    group   => $fail2ban::config_file_group,
+    require => Package[$fail2ban::package],
+    notify  => $fail2ban::manage_service_autorestart,
+    source  => $manage_file_source,
+    content => $manage_file_content,
+    replace => $fail2ban::manage_file_replace,
+    audit   => $fail2ban::manage_audit,
+    noop    => $fail2ban::bool_noops,
+  }
+
+}