Defined Type: fail2ban::jail

Defined in:
manifests/jail.pp

Summary

Setup a fail2ban jail to reduce effectiveness of bruteforce.

Overview

fail2ban/manifests/jail.pp

  • Copyright (C) 2014-2018 gabster@lelutin.ca

Jails are the top level of fail2ban configuration; what you'll be using most often to setup protection of a service from bruteforce attempts or pesky attack traffic. They rely on a filter to find out IPs that are doing mischief, and then use an action to ban (and subsequently unban) IPs.

Most parameters of this defined type are used for overriding what has been set in the global context in jail.conf/jail.local (see parameters to the fail2ban class). They are not mandatory if you can reuse the global values.

Parameters:

  • ensure (Enum['present','absent']) (defaults to: 'present')

    Whether resources for the defined jail should be installed or removed.

  • enabled (Boolean) (defaults to: true)

    Whether or not a jail is enabled. Setting this to false makes it possible to keep configuration around for a certain jail but temporarily disable it.

  • port (Optional[Fail2ban::Port]) (defaults to: undef)

    Comma separated list of ports, port ranges or service names (as found in /etc/services) that should get blocked by the ban action.

  • filter (Optional[String]) (defaults to: undef)

    Name of the filter to use for this jail. The default value for the filter is usually to use a filter with the same name as the jail name (although this could be changed by the filter parameter on the fail2ban class).

  • logpath (Optional[String]) (defaults to: undef)

    Absolute path to the log file against which regular expressions should be verified to catch activity that you want to block.

  • protocol (Optional[Fail2ban::Protocol]) (defaults to: undef)

    Name of the protocol to ban using the action.

  • maxretry (Optional[Integer]) (defaults to: undef)

    Number of failregex matches during findtime after which an IP gets banned.

  • findtime (Optional[Integer]) (defaults to: undef)

    Time period in seconds during which maxretry number of matches will get an IP banned.

  • ignorecommand (Optional[String]) (defaults to: undef)

    Command used to determine if an IP should found by a failregex be ignored. This can be used to have a more complex and dynamic method of listing and identifying IPs that should not get banned. It can be used also when ignoreip is present.

  • action (Optional[String]) (defaults to: undef)

    Name of and parameters to the action that should be used to ban and unban IPs when maxretry matches of failregex has happened for an IP during findtime.

  • usedns (Optional[Fail2ban::Usedns]) (defaults to: undef)

    Whether or not to resolve DNS hostname of IPs that have been found by a failregex.

  • banaction (Optional[String]) (defaults to: undef)

    Name of the action that is extrapolated in default action definitions, or in the action param. This can let you override the action name but keep the default parameters to the action.

  • bantime (Optional[Integer]) (defaults to: undef)

    Time period in seconds for which an IP is banned if maxretry matches of failregex happen for the same IP during findtime.

  • ignoreip (Array[String, 0]) (defaults to: [])

    List of IPs or CIDR prefixes to ignore when identifying matches of failregex. The IPs that fit the descriptions in this parameter will never get banned by the jail.

  • backend (Optional[Fail2ban::Backend]) (defaults to: undef)

    Method used by fail2ban to obtain new log lines from the log file in logpath.

  • additional_options (Hash[String, String]) (defaults to: {})

    Hash of additional values that should be declared of the jail. Keys are the value name and values are placed to the right of the “=”. This can be used to declare arbitrary values for filters or actions to use. No syntax checking is done on the contents of this hash.



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# File 'manifests/jail.pp', line 73

define fail2ban::jail (
  Enum['present','absent']     $ensure             = 'present',
  Boolean                      $enabled            = true,
  # Params that override default settings for a particular jail
  Optional[Fail2ban::Port]     $port               = undef,
  Optional[String]             $filter             = undef,
  Optional[String]             $logpath            = undef,
  Optional[Fail2ban::Protocol] $protocol           = undef,
  Optional[Integer]            $maxretry           = undef,
  Optional[Integer]            $findtime           = undef,
  Optional[String]             $ignorecommand      = undef,
  Optional[String]             $action             = undef,
  Optional[Fail2ban::Usedns]   $usedns             = undef,
  Optional[String]             $banaction          = undef,
  Optional[Integer]            $bantime            = undef,
  Array[String, 0]             $ignoreip           = [],
  Optional[Fail2ban::Backend]  $backend            = undef,
  Hash[String, String]         $additional_options = {},
) {
  include fail2ban::config

  if $backend == 'systemd' {
    if $logpath {
      fail('logpath must not be set when $backend is \'systemd\'')
    }
  }
  else {
    if $logpath == false {
      fail('logpath must be set unless $backend is \'systemd\'')
    }
  }

  if $port == 'all' {
    $portrange = '1:65535'
  }
  else
  {
    $portrange = $port
  }

  file { "/etc/fail2ban/jail.d/${name}.conf":
    ensure  => $ensure,
    content => template('fail2ban/jail.erb'),
    owner   => 'root',
    group   => 0,
    mode    => '0644',
    notify  => Class['fail2ban::service']
  }

}