Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status

RSS

fail2ban (54) Versions 2.1.0

Installs and configures fail2ban

Policyfile
Berkshelf
Knife
cookbook 'fail2ban', '= 2.1.0', :supermarket
cookbook 'fail2ban', '= 2.1.0'
knife supermarket install fail2ban
knife supermarket download fail2ban
README
Dependencies
Quality -%

Description

Installs and configures fail2ban, a utility that watches logs for failed login attempts
and blocks repeat offenders with firewall rules. On Redhat systems this cookbook will
enable the EPEL repository in order to retrieve the fail2ban package.

Requirements

Chef version 0.10.10+ and Ohai 0.6.12+ are required.

Platform

  • Debian, Ubuntu
  • Red Hat Enterprise Linux (CentOS/Amazon/Scientific/Oracle)
  • Fedora

Cookbooks

  • yum

Recipes

default

Installs the fail2ban package, manages 2 templates: /etc/fail2ban/fail2ban.conf
and /etc/fail2ban/jail.conf, and manages the fail2ban service.

Usage

Typically, include recipe[fail2ban] in a base role applied to all nodes.

Attributes

This cookbook makes use of a hash to compile the jail.local-file:

default['fail2ban']['services'] = {
  'ssh' => {
        "enabled" => "true",
        "port" => "ssh",
        "filter" => "sshd",
        "logpath" => node['fail2ban']['auth_log'],
        "maxretry" => "6"
     },
  'smtp' => {
        "enabled" => "true",
        "port" => "smpt",
        "filter" => "smtp",
        "logpath" => node['fail2ban']['auth_log'],
        "maxretry" => "6"
     }
}

The following attributes can be used per service:

  • enabled
  • port
  • filter
  • logpath
  • maxretry
  • protocol
  • banaction

Particular those related to rsyslog

If you are using rsyslog parameter "$RepeatedMsgReduction on" in rsyslog.conf file
then you can get "Last message repeated N times" in system log file (for example auth.log).
And it will affect the work of fail2ban, so that fail2ban will not work because the internal counter maxretry will not extend their
Then you can change parameter "$RepeatedMsgReduction off" in rsyslog.conf file for maximum accuracy of maximum failed login attempts

This rsyslog parameter is default ON for ubuntu 12.04 LTS for example.

License and Author

Author:: Joshua Timberman

Copyright:: 2009-2013, Opscode, Inc

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

No quality metric results found