WIP: __fail2ban new type #379
Draft
smwltr
wants to merge 1 commit from
smwltr:fail2ban into master
pull from: smwltr:fail2ban
merge into: ungleich-public:master
ungleich-public:master
ungleich-public:7.0
ungleich-public:6.9
ungleich-public:py3.10
ungleich-public:ander/__package_apt_update_index
ungleich-public:haproxy-dualstack
ungleich-public:ander/__sed
ungleich-public:beta
ungleich-public:ander/os_version_debian_sid
ungleich-public:evilham-compatibility-fixes
ungleich-public:ander/__rsync
ungleich-public:__snakeoil_cert
ungleich-public:ander/update_readme
ungleich-public:__download_improvements
ungleich-public:feature/onchange
ungleich-public:cleanup/string-formatting
ungleich-public:feature/type-relationship-graph
ungleich-public:cleanup/ssh-auth-keys-types
ungleich-public:__letsencrypt_cert-fix-hooks
ungleich-public:bugfix/preos-debug
ungleich-public:bugfix/in-script-import
ungleich-public:6.8
ungleich-public:bugfix/sphinx-docs-build
ungleich-public:6.7
ungleich-public:cherry-pick-2f433a14
ungleich-public:bugfix/make-code-consistent
ungleich-public:6.6
ungleich-public:regain-py3.2-support
ungleich-public:6.5
ungleich-public:bugfix/multiple-log-lines
ungleich-public:matterbridge
ungleich-public:coturn
ungleich-public:alpinefix
ungleich-public:matrix
ungleich-public:new-type/network-interface
ungleich-public:feature/process
ungleich-public:6.4
ungleich-public:feature/info-command
ungleich-public:feature/libexec
ungleich-public:6.3
ungleich-public:preos-plugins-dir-opt
ungleich-public:gitlab-ci
ungleich-public:6.2
ungleich-public:order-dep-fix
ungleich-public:6.1
ungleich-public:6.0
ungleich-public:build/support-pip-from-git
ungleich-public:feature/shell-lib
ungleich-public:5.1
ungleich-public:feature/support-type-deprecation
ungleich-public:5.0
ungleich-public:feature/python-types
ungleich-public:4.11
ungleich-public:4.10
ungleich-public:shellcheck
ungleich-public:4.9
ungleich-public:4.8
ungleich-public:freebsd-improvements
ungleich-public:new-prometheus
ungleich-public:key_value-onchange
ungleich-public:feature/output_streams
ungleich-public:AnotherKamila-patch-1
ungleich-public:__letsencrypt_cert-fixes
ungleich-public:letsencrypt-cron-fix
ungleich-public:4.7
ungleich-public:newtype-__letsencrypt_cert
ungleich-public:os_explorer_devuan_fix
ungleich-public:prometheus-exporter-fixes
ungleich-public:daemontools-for-fbsd
ungleich-public:type-prometheus-exporter-from-master
ungleich-public:prometheus-more-fixes
ungleich-public:4.6
ungleich-public:4.5
ungleich-public:fix-j
ungleich-public:steven-backport
ungleich-public:4.4
ungleich-public:prometheus-fixes
ungleich-public:grafana_dashboard
ungleich-public:prometheus
ungleich-public:daemontools
ungleich-public:consul_improvements
ungleich-public:feature/trigger
ungleich-public:4.3
ungleich-public:4.0-pre-not-stable
ungleich-public:4.2
ungleich-public:4.1
ungleich-public:4.0
ungleich-public:feature_install_and_preos
ungleich-public:3.1
ungleich-public:no-dot-cdist
ungleich-public:random_dot_cdist
ungleich-public:feature_yum_url
ungleich-public:feature_files_export
ungleich-public:3.0
ungleich-public:2.3
ungleich-public:2.2
ungleich-public:2.1
ungleich-public:ssh_callback
ungleich-public:2.0
ungleich-public:archive_shell_function_approach
ungleich-public:1.7
ungleich-public:1.6
ungleich-public:1.5
ungleich-public:1.4
ungleich-public:1.3
ungleich-public:1.2
ungleich-public:1.1
ungleich-public:1.0
No reviewers
fnux
Labels
No labels
bugfix
cleanup
discussion
documentation
doing
done
feature
improvement
packaging
Stale
testing
TODO
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set.
Reference: ungleich-public/cdist#379
Reference in a new issue
No description provided.
Delete branch "smwltr:fail2ban"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Does this need anything other than a man page?
WIP: __fail2banto WIP: __fail2ban new type@ -0,0 +30,4 @@doecho "[$(tput setaf 6)info$(tput sgr 0)] Enabling fail2ban for $service..." >&2cat << EOFperl -i -pe 'BEGIN{undef $/;} s/\[$service\].*[\n]*enabled.*=.*\n/\[$service\]\n\nenabled = true\n/g' $config_fileI see two problems here:
perlin core cdist types - we only assume POSIX sh on the remote hosts.@ -0,0 +31,4 @@require=__package/epel-release __package fail2ban --state present;;*)echo "Your operating system ($os) is currently untested for ${__type##*/}." >&2Just say that the type does not support
$osand exit.I'll need to make a testing set up for this. It's most likely that other OSes can use the same code, but I just haven't tested it.
Well, we only ship code that is known to be working :-)
@ -0,0 +36,4 @@__package fail2ban --state present;;esacYou also have to make sure that the fail2ban service starts on boot.
Is that typically what we do?
Or do we expect the user to use
__start_on_boot?Maybe I should rather fail when there is no fail2ban package installed. Then this type would be only for configuring the services that you want fail2ban to monitor (jails).
I could make an opiton and default to start it. Or I could add
__start_on_bootand__packageas an example in the man page?What fits more with the cdist design?
We usually install and enable (i.e. start_on_boot) the service within the type. Please run both
__packageand__start_on_bootin your type.IMO, forcing something other than the default is not my style, but if that is standard cdist style, so be it.
@ -0,0 +1 @@enable-servicesI find this parameter confusing - could you rename it? e.g.
jail-service?Would it be
enable-jail? I suppose we needdisable-jailtoo. Or?The type could generate configuration for the services specified in
--jail-serviceand remove anything that isn't provided. You could make--jail-servicean optional_multiple parameter.Also mind that if we need to add per-service/jail configuration, a second __fail2ban_jail service will be needed (so that every jailed service can have its own configuration).
IIUC, that would mean that cdist team be responsible for shipping working tested config for fail2ban.
Do you think that is out of scope? Have you seen how many jails are in the default config?
That's the reason why all this type does is allow you to enable a jail that is already in the config.
Before I remove the perl code, I'd like to understand this more. If we are just dis/enabling jails from the config, I can use sed. But generating a config for fail2ban requires much more code and maintenance. It doesn't make sense to me.
WDYT?
IT would be a generic type to deploy a file in /etc/fail2ban/jail.d/myjail.conf (on debian at least). It doesn't have to support every configuration parameter, but should allow for custom configuration.
Its simplest form could looks like:
I would also run
fail2ban-client --testor similar in gencode-remote before reloading the configuration.@fnux, sorry for the n00b question: how do I update a PR from my fork? I've pushed some changes, but I don't see them here.
There's currently an issue with this gitea instance. I asked ungleich to investigate it.
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.