This module installs, configures and manages the Fail2ban service.
This module handles installing, configuring and running Fail2ban across a range of operating systems and distributions.
Install and configure fail2ban:
class { 'fail2ban': }
You can also manually specify a different configuration template. To do it, use your desired configuration template (e.g. if your template is in your local profile):
class { 'fail2ban': config_file_template => "profile/fail2ban/etc/fail2ban/jail.conf.epp" }
Or using Hiera:
fail2ban::config_file_template: "profile/fail2ban/etc/fail2ban/jail.conf.epp"
Update the fail2ban package.
class { 'fail2ban': package_ensure => 'latest', }
Remove the fail2ban package.
class { 'fail2ban': package_ensure => 'absent', }
Purge the fail2ban package (All configuration files will be removed).
class { 'fail2ban': package_ensure => 'purged', }
Deploy the configuration files from source directory.
class { 'fail2ban': config_dir_source => "puppet:///modules/profile/fail2ban/etc/fail2ban", }
Deploy the configuration files from source directory (Unmanaged configuration files will be removed).
class { 'fail2ban': config_dir_purge => true, config_dir_source => "puppet:///modules/profile/fail2ban/etc/fail2ban", }
Deploy the configuration file from source.
class { 'fail2ban': config_file_source => "puppet:///modules/profile/fail2ban/etc/fail2ban/jail.conf", }
Deploy the configuration file from string.
class { 'fail2ban': config_file_string => '# THIS FILE IS MANAGED BY PUPPET', }
Deploy the configuration file from template.
class { 'fail2ban': config_file_template => "profile/fail2ban/etc/fail2ban/jail.conf.epp", }
Deploy the configuration file from custom template (Additional parameters can be defined).
class { 'fail2ban': config_file_template => "profile/fail2ban/etc/fail2ban/jail.conf.epp", config_file_options_hash => { 'key' => 'value', }, }
Deploy additional configuration files from source, string or template.
class { 'fail2ban': config_file_hash => { 'jail.2nd.conf' => { config_file_path => '/etc/fail2ban/jail.2nd.conf', config_file_source => "puppet:///modules/profile/fail2ban/etc/fail2ban/jail.2nd.conf", }, 'jail.3rd.conf' => { config_file_path => '/etc/fail2ban/jail.3rd.conf', config_file_string => '# THIS FILE IS MANAGED BY PUPPET', }, 'jail.4th.conf' => { config_file_path => '/etc/fail2ban/jail.4th.conf', config_file_template => "profile/fail2ban/etc/fail2ban/jail.4th.conf.epp", }, }, }
Disable the fail2ban service.
class { 'fail2ban': service_ensure => 'stopped', }
package_ensureDetermines if the package should be installed. Valid values are ‘present’, ‘latest’, ‘absent’ and ‘purged’. Defaults to ‘present’.
package_nameDetermines the name of package to manage. Defaults to ‘fail2ban’.
package_listDetermines if additional packages should be managed. Defaults to ‘undef’.
config_dir_ensureDetermines if the configuration directory should be present. Valid values are ‘absent’ and ‘directory’. Defaults to ‘directory’.
config_dir_pathDetermines if the configuration directory should be managed. Defaults to ‘/etc/fail2ban’
config_dir_purgeDetermines if unmanaged configuration files should be removed. Valid values are ‘true’ and ‘false’. Defaults to ‘false’.
config_dir_recurseDetermines if the configuration directory should be recursively managed. Valid values are ‘true’ and ‘false’. Defaults to ‘true’.
config_dir_sourceDetermines the source of a configuration directory. Defaults to ‘undef’.
config_file_pathDetermines if the configuration file should be managed. Defaults to ‘/etc/fail2ban/jail.conf’
config_file_ownerDetermines which user should own the configuration file. Defaults to ‘root’.
config_file_groupDetermines which group should own the configuration file. Defaults to ‘root’.
config_file_modeDetermines the desired permissions mode of the configuration file. Defaults to ‘0644’.
config_file_sourceDetermines the source of a configuration file. Defaults to ‘undef’.
config_file_stringDetermines the content of a configuration file. Defaults to ‘undef’.
config_file_templateDetermines the content of a configuration file. Defaults to ‘undef’.
config_file_notifyDetermines if the service should be restarted after configuration changes. Defaults to ‘Service[fail2ban]’.
config_file_requireDetermines which package a configuration file depends on. Defaults to ‘Package[fail2ban]’.
config_file_hashDetermines which configuration files should be managed via fail2ban::define. Defaults to ‘{}’.
config_file_options_hashDetermines which parameters should be passed to an ERB template. Defaults to ‘{}’.
manage_defaultsDetermines whether the file /etc/fail2ban/jail.d/defaults-debian.conf should be deleted or not. Defaults to ‘absent’.
manage_firewalldDetermines whether the file /etc/fail2ban/jail.d/00-firewalld.conf should be deleted or not. Defaults to ‘absent’.
service_ensureDetermines if the service should be running or not. Valid values are ‘running’ and ‘stopped’. Defaults to ‘running’.
service_nameDetermines the name of service to manage. Defaults to ‘fail2ban’.
service_enableDetermines if the service should be enabled at boot. Valid values are ‘true’ and ‘false’. Defaults to ‘true’.
actionDetermines how banned ip addresses should be reported. Defaults to ‘action_mb’.
bantimeDetermines how many seconds ip addresses will be banned. Defaults to ‘432000’.
emailDetermines which email address should be notified about restricted hosts and suspicious logins. Defaults to “fail2ban@${::domain}”.
senderDetermines which email address should notify about restricted hosts and suspicious logins. Defaults to ‘fail2ban@${::fqdn}’.
iptables_chainDetermines chain where jumps will to be added in iptables-* actions. Defaults to ‘INPUT’.
jailsDetermines which services should be protected by Fail2ban. Defaults to ‘[‘ssh’, ‘ssh-ddos’]’.
maxretryDetermines the number of failed login attempts needed to block a host. Defaults to ‘3’.
whitelistDetermines which ip addresses will not be reported. Defaults to ‘[‘127.0.0.1/8’, ‘192.168.56.0/24’]’.
custom_jailsDetermines which custom jails should be included (see Custom jails.
banactionDetermines which action to perform when performing a global ban (not overridden in a specific jail).
Users can add their own jails by using this YAML definition:
--- fail2ban::custom_jails: 'nginx-wp-login': filter_failregex: '<HOST>.*] "POST /wp-login.php' port: 'http,https' logpath: '/var/log/nginx/access.log' maxretry: 3 findtime: 120 bantime: 1200 ignoreip: ['127.0.0.1', '192.168.1.1/24'] 'nginx-login': filter_failregex: '^<HOST> -.*POST /sessions HTTP/1\.." 200' action: 'iptables-multiport[name=NoLoginFailures, port="http,https"]' logpath: '/var/log/nginx*/*access*.log' maxretry: 6 bantime: 600 ignoreip: ['127.0.0.1', '192.168.1.1/24']
Default e-mail notification are defined in /etc/fail2ban/action.d/sendmail-common.conf. Following configuration will create override config sendmail-common.local.
fail2ban::sendmail_actions: actionstart: '' actionstop: '' fail2ban::sendmail_config: dest: root@localhost sender: fail2ban@localhost sendername: Fail2Ban
This module has been tested on:
If you find a bug, have trouble following the documentation or have a question about this module - please create an issue.
If you are able to patch the bug or add the feature yourself - please make a pull request.
The list of contributors can be found at: https://github.com/voxpupuli/puppet-fail2ban/graphs/contributors