Mercurial > repos > other > Puppet
annotate modules/fail2ban/templates/ibb-sshd-bad-user.epp @ 292:3e04f35dd0af
Turn Fail2ban setup into a module
We now:
* Don't have a large class outside a module
* Build "bad SSH users" config from a list
(easier to understand/see diffs in than a long line)
* Use modern EPP files
author | IBBoard <dev@ibboard.co.uk> |
---|---|
date | Sat, 18 Jan 2020 15:17:03 +0000 |
parents | common/fail2ban/ibb-sshd-bad-user.conf@d2ae0b786b49 |
children | 79e5fed321fa |
rev | line source |
---|---|
292
3e04f35dd0af
Turn Fail2ban setup into a module
IBBoard <dev@ibboard.co.uk>
parents:
291
diff
changeset
|
1 <%- | Array $bad_users | -%> |
197
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
2 # Fail2Ban configuration file |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
3 # Author: IBBoard |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
4 |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
5 [Definition] |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
6 |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
7 # Option: failregex |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
8 # Notes.: regex to match the password failures messages in the logfile. The |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
9 # host must be matched by a group named "host". The tag "<HOST>" can |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
10 # be used for standard IP/hostname matching and is only an alias for |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
11 # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+) |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
12 # Values: TEXT |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
13 # |
292
3e04f35dd0af
Turn Fail2ban setup into a module
IBBoard <dev@ibboard.co.uk>
parents:
291
diff
changeset
|
14 failregex = Failed password for invalid user (<%= join($bad_users, '|') %>)? from <HOST> port [0-9]+ ssh2 |
197
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
15 |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
16 # Option: ignoreregex |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
17 # Notes.: regex to ignore. If this regex matches, the line is ignored. |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
18 # Values: TEXT |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
19 # |
23c4f6a38b57
Make Fail2Ban SSH rules more agressive
IBBoard <dev@ibboard.co.uk>
parents:
diff
changeset
|
20 ignoreregex = |