cookbook 'fail2ban', '= 2.2.0'
fail2ban
(54) Versions
2.2.0
-
-
7.0.23
-
7.0.22
-
7.0.21
-
7.0.20
-
7.0.19
-
7.0.18
-
7.0.17
-
7.0.16
-
7.0.15
-
7.0.14
-
7.0.13
-
7.0.12
-
7.0.11
-
7.0.10
-
7.0.9
-
7.0.8
-
7.0.7
-
7.0.6
-
7.0.5
-
7.0.4
-
7.0.3
-
7.0.2
-
7.0.1
-
7.0.0
-
6.3.3
-
6.3.2
-
6.3.1
-
6.3.0
-
6.2.1
-
6.2.0
-
6.1.0
-
6.0.0
-
5.0.2
-
5.0.1
-
5.0.0
-
4.0.1
-
4.0.0
-
3.1.0
-
2.3.1
-
2.3.0
-
2.2.1
-
2.2.0
-
2.1.2
-
2.1.0
-
2.0.4
-
2.0.2
-
2.0.0
-
1.2.4
-
1.2.2
-
1.2.0
-
1.1.0
-
1.0.2
-
1.0.0
-
0.7.0
Follow85
- 7.0.23
- 7.0.22
- 7.0.21
- 7.0.20
- 7.0.19
- 7.0.18
- 7.0.17
- 7.0.16
- 7.0.15
- 7.0.14
- 7.0.13
- 7.0.12
- 7.0.11
- 7.0.10
- 7.0.9
- 7.0.8
- 7.0.7
- 7.0.6
- 7.0.5
- 7.0.4
- 7.0.3
- 7.0.2
- 7.0.1
- 7.0.0
- 6.3.3
- 6.3.2
- 6.3.1
- 6.3.0
- 6.2.1
- 6.2.0
- 6.1.0
- 6.0.0
- 5.0.2
- 5.0.1
- 5.0.0
- 4.0.1
- 4.0.0
- 3.1.0
- 2.3.1
- 2.3.0
- 2.2.1
- 2.2.0
- 2.1.2
- 2.1.0
- 2.0.4
- 2.0.2
- 2.0.0
- 1.2.4
- 1.2.2
- 1.2.0
- 1.1.0
- 1.0.2
- 1.0.0
- 0.7.0
Installs and configures fail2ban
cookbook 'fail2ban', '= 2.2.0', :supermarket
knife supermarket install fail2ban
knife supermarket download fail2ban
Description
Installs and configures fail2ban
, a utility that watches logs for failed login attempts
and blocks repeat offenders with firewall rules. On Redhat systems this cookbook will
enable the EPEL repository in order to retrieve the fail2ban package.
Requirements
Chef version 0.10.10+ and Ohai 0.6.12+ are required.
Platform
- Debian, Ubuntu
- Red Hat Enterprise Linux (CentOS/Amazon/Scientific/Oracle)
- Fedora
Cookbooks
- yum
Recipes
default
Installs the fail2ban package, manages 2 templates: /etc/fail2ban/fail2ban.conf
and /etc/fail2ban/jail.conf
, and manages the fail2ban service.
Usage
Typically, include recipe[fail2ban]
in a base role applied to all nodes.
Attributes
This cookbook makes use of a hash to compile the jail.local-file and filter config files:
default['fail2ban']['services'] = {
'ssh' => {
"enabled" => "true",
"port" => "ssh",
"filter" => "sshd",
"logpath" => node['fail2ban']['auth_log'],
"maxretry" => "6"
},
'smtp' => {
"enabled" => "true",
"port" => "smtp",
"filter" => "smtp",
"logpath" => node['fail2ban']['auth_log'],
"maxretry" => "6"
}
}
The following attributes can be used per service:
- enabled
- port
- filter
- logpath
- maxretry
- protocol
- banaction
Creating custom fail2ban filters:
default['fail2ban']['filters'] = {
'nginx-proxy' => {
"failregex" => ["^ -.*GET http.*"],
"ignoreregex" => []
},
}
Particular those related to rsyslog
If you are using rsyslog parameter "$RepeatedMsgReduction on" in rsyslog.conf file
then you can get "Last message repeated N times" in system log file (for example auth.log).
And it will affect the work of fail2ban, so that fail2ban will not work because the internal counter maxretry will not extend their
Then you can change parameter "$RepeatedMsgReduction off" in rsyslog.conf file for maximum accuracy of maximum failed login attempts
This rsyslog parameter is default ON for ubuntu 12.04 LTS for example.
License and Author
Author:: Joshua Timberman
Copyright:: 2009-2013, Opscode, Inc
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
fail2ban Cookbook CHANGELOG
This file is used to list changes made in each version of the fail2ban cookbook.
v2.2.0
- #15 - Fix small typo in README.md for smtp
- #16 - Support custom fail2ban filters
- #21 - Service and defaults improvements, Fedora support
v2.1.2
Improvement
- COOK-3899 - Allow action override in service block
v2.1.0
Updating for cookbook yum ~> 3.0
Fixing style or rubocop
Updating test bits
v2.0.4
fixing metadata version error. locking to 3.0
v2.0.2
Locking yum dependency to '< 3'
v2.0.0
[COOK-2530] Allow customisation of jail.local
v1.2.4
New Feature
- COOK-3383 - Add clarifying caveat about rsyslog in README
Bug
-
COOK-3249 - Fix default
jail.conf
on CentOS
Improvement
-
COOK-2748 - Handle
/etc.init.d/fail2ban status
for older versions
v1.2.2
Bug
- [COOK-2588]: Fail2ban needs to store the socket in the correct location
- [COOK-2592]: fail2ban: Update jail file template to match current config file
v1.2.0
- [COOK-2292] - Add fail2ban support for RHEL using EPEL
- [COOK-2426] - Fail2ban cookbook needs syslog tunables in config file
- Development repository only: test kitchen 1.0.alpha support
v1.1.0
- [COOK-2291] - Add additional tunables to the fail2ban cookbook
v1.0.2
- [COOK-2217] - Users should be able to configure the email address fail2ban uses to send messages
v1.0.0
- Current public release.