Issue 2487 - Introduce fail2ban module

modules/fail2ban/manifests/init.pp

Index: modules/fail2ban/manifests/init.pp
===================================================================
new file mode 100644
--- /dev/null
+++ b/modules/fail2ban/manifests/init.pp
@@ -0,0 +1,81 @@
+# == Class: fail2ban
+#
+# Create and maintain fail2ban (http://www.fail2ban.org/) setups.
+#
+# == Parameters:
+#
+# [*jail_config*]
+#   Adds jail.local to the default configuration of fail2ban
+#
+# [*package*]
+#   Overwrite the default package options, to fine-tune the target version (i.e.
+#   ensure => 'latest') or remove fail2ban (ensure => 'absent' or 'purged')
+#
+# [*service*]
+#   Overwrite the default service options.
+#
+# [*filters*]
+#   Adds adittional filters to the filters.d folder
+# === Examples:
+#
+#   class {'fail2ban':
+#     package => {ensure => 'present',},
+#     service => {},
+#     jail_config => {

[f.nicolaisen, 2016/11/25 16:23:29]

We should require setting a port here, and if not we should switch to using the
iptables-allports.conf action.

[f.lopez, 2016/11/25 17:41:10]

That is the actual motive for this kinda of configuration, to use whatever we
feel like, see matze's comment on the jail.local template file, I still don't
know how to make that work but then it would work flawlessly

+#       'wordpress' => {
+#         logpath => '/var/log/nginx/access.log',
+#       },
+#     },
+#     filters => {
+#       'wordpress' => {
+#         failregex => [
+#           '^<HOST>.*\"WordPress\/.*',
+#         ],
+#       }
+#     },
+#   }
+class fail2ban (
+  $package = hiera('fail2ban::package', 'present'),
+  $service = hiera('fail2ban::service', {}),
+  $jail_config = hiera('fail2ban::jail_config', {}),
+  $filters = hiera('fail2ban::filters', {}),
+) {
+
+  include stdlib
+
+  ensure_resource('package', $title, {ensure => $package})
+
+  # Used as default $ensure parameter for most resources below
+  $ensure = getparam(Package[$title], 'ensure') ? {
+    /^(absent|purged)$/ => 'absent',
+    default => 'present',
+  }
+
+  # Service resources don't properly support the concept of absence
+  if ($ensure == 'present') {
+
+    ensure_resource('service', $title, $service)
+    # See modules/fail2ban/manifests/filter.pp
+    create_resources('fail2ban::filter', $filters)
+
+    # According to the docs one can also enable filters that are
+    # already in there, so the config file should be done indepentently
+    # of the filters, another thing to consider is the possibility of
+    # having the filters configured but not activated, so no conf is
+    # passed.
+    if jail_config != undef {
+      file {'/etc/fail2ban/jail.local':

[f.nicolaisen, 2016/11/25 16:23:29]

Like stated earlier, if no ports have been configured, we should set action to
use /etc/fail2ban/action.d/iptables-allports.conf instead of default action
(iptables).

+        ensure => present,
+        group => 'root',
+        mode => '0644',
+        owner => 'root',
+        content => template("fail2ban/jail.erb"),
+        notify => Service[$title],
+      }
+    }
+
+    Package[$title] -> File['/etc/fail2ban/jail.local']
+
+  }
+
+}