name: Fail2Ban
id: fail2ban
version: 0.9.6
type: update
jpsVersion: '0.8'

categories:
- apps/others
- apps/management-and-monitoring
description:
  text: Fail2Ban is an intrusion prevention software framework that protects servers from brute-force attacks. It scans log files and bans IP addresses that make too many failed login attempts. The exact actions are customizable and temporary (made through firewall rules adjustments).
  short: Fail2Ban is an intrusion prevention software framework that protects servers from brute-force attacks.

settings:
  removeSettings:
    fields:
    - caption: Banned IP
      name: bannedip
      required: true
      type: string
      regex: "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$"
      regexText: Not valid IP address.

homepage: https://github.com/fail2ban/fail2ban
logo: /images/Fail2Ban.png
baseUrl: https://raw.githubusercontent.com/jelastic-jps/fail2ban/master/

targetNodes:
  nodeType:
  - tomcat6
  - tomcat7
  - tomcat8
  - tomcat85
  - tomcat9
  - tomcat
  - tomee
  - tomee-dockerized
  - glassfish3
  - glassfish4
  - glassfish
  - jetty6
  - apache
  - apache2
  - nginxphp
  - apache2-ruby
  - nginx-ruby
  - nginx
  - nginx-dockerized
  - nginxphp-dockerized
  - haproxy
  - apache-lb
  - varnish
  - varnish-dockerized

globals:
  installScript: "${baseUrl}/scripts/install.sh"
  setupScript: "${baseUrl}/scripts/setup.sh"
  removeScript: "${baseUrl}/scripts/remove.sh"
  documentationLink: http://www.fail2ban.org/wiki/index.php/Manual
  txtPath: /var/lib/jelastic/keys/bannedip.txt

menu:
- caption: Service Status
  confirmText: You are going to check Fail2Ban service status. Continue?
  loadingText: Checking..
  procedure: statusFail2ban
- caption: Service Restart
  confirmText: You are going to restart Fail2Ban. Continue?
  loadingText: Restarting..
  procedure: restartFail2ban
  successText: Fail2Ban has been restarted.
- caption: Service Stop
  confirmText: You are going to stop Fail2Ban. Continue?
  loadingText: Stopping..
  procedure: stopFail2ban
  successText: Fail2Ban has been stopped.


buttons:
- caption: Check if IP is banned
  confirmText: You are going to check if the IP is banned. Continue?
  loadingText: Checking..
  procedure: checkIP
  settings: removeSettings
  successText: The IP has been checked.
- caption: Unban IP
  confirmText: You are going to remove the IP from the "ban" list. Continue?
  loadingText: Removing the IP..
  procedure: removeIP
  settings: removeSettings
  successText: The IP has been removed from the "ban" list.


onInstall:
- installFail2ban
- setupFail2ban

onUninstall: removeFail2Ban

onBeforeRedeployContainer [${targetNodes.nodeGroup}]: removeFail2Ban

onAfterRedeployContainer [${targetNodes.nodeGroup}]:
- installFail2ban
- setupFail2ban
- cmd [${targetNodes.nodeGroup}]: cat ${globals.txtPath}
- removeIP:
    bannedip: ${response.out}

actions:
  removeIP:
    - cmd [${targetNodes.nodeGroup}]: echo '${this.bannedip}' > /var/lib/jelastic/keys/bannedip.txt; for jail in $(fail2ban-client status | awk -F 'Jail list:' '{ print $2}' | grep -oE '[a-z0-9\-]*'); do fail2ban-client set $jail unbanip ${this.bannedip} 2>&1 | echo '${this.bannedip} was unbanned at '$jail; done
      user: root
    - message: ${response.out}.
      script: |
        return {result: 'info', message: message.replace(/\n/g, '  \n')}
  checkIP:
    - cmd [${targetNodes.nodeGroup}]: echo -n "${this.bannedip} "; list="$(fail2ban-client banned ${this.bannedip} | grep -v '[[]]')"; if [ $? -ne 0 ]; then echo "is not banned"; else echo "is banned in ${list}";fi;
      user: root
    - message: ${response.out}.
      script: |
        return {result: 'info', message: message.replace(/\n/g, '  \n')}
  installFail2ban:
    cmd [${targetNodes.nodeGroup}]:
    - curl -sSfL "${globals.installScript}" -o /var/lib/jelastic/keys/install.sh 2>&1
    - "/bin/bash /var/lib/jelastic/keys/install.sh"
    - curl -sSfL "${baseUrl}/scripts/sudo_fail2ban" -o /etc/sudoers.d/fail2ban
    - chmod 640 /etc/sudoers.d/fail2ban;
    - curl -fsSL '${baseUrl}/scripts/profile_fail2ban' -o /etc/profile.d/fail2ban.sh;
    - chown -R jelastic /etc/fail2ban
    user: root
  setupFail2ban:
    cmd [${targetNodes.nodeGroup}]:
    - curl -sSfL "${globals.setupScript}" -o /var/lib/jelastic/keys/setup.sh 2>&1
    - /bin/bash /var/lib/jelastic/keys/setup.sh "${user.email}" "${baseUrl}"
    user: root
  removeFail2Ban:
    cmd [${targetNodes.nodeGroup}]:
    - curl -sSfL "${globals.removeScript}" -o /var/lib/jelastic/keys/remove.sh 2>&1
    - "/bin/bash /var/lib/jelastic/keys/remove.sh"
    - rm -f /etc/sudoers.d/fail2ban /etc/profile.d/fail2ban.sh
    user: root
  restartFail2ban:
    - cmd [${targetNodes.nodeGroup}]:
      - systemctl restart fail2ban 2>/dev/null 1>/dev/null
      - systemctl is-active fail2ban
      - echo -n ""
      user: root
    - message: Fail2Ban has been restarted. Service is ${response.out}.
      script: |
        return {result: 'success', message: message.replace(/\n/g, '  \n')}
  stopFail2ban:
    - cmd [${targetNodes.nodeGroup}]:
      - systemctl stop fail2ban  2>/dev/null 1>/dev/null
      - systemctl is-active fail2ban
      - echo -n ""
      user: root
    - message: Fail2Ban has been stopped. Service is ${response.out}.
      script: |
        return {result: 'success', message: message.replace(/\n/g, '  \n')}
  statusFail2ban:
    - cmd [${targetNodes.nodeGroup}]:
      - systemctl is-active fail2ban
      - echo -n ""
      user: root
    - message: Fail2Ban service is ${response.out}.
      script: |
        return {result: 'success', message: message.replace(/\n/g, '  \n')}

success: The Fail2Ban add-on has been installed successfully. To customize add-on behavior for your environment, please refer to the [documentation](${globals.documentationLink}).