Adding upstream version 1.12.0.upstream/1.12.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

4 files changed, 312 insertions, 0 deletions

diff --git a/collectors/python.d.plugin/fail2ban/Makefile.inc b/collectors/python.d.plugin/fail2ban/Makefile.inc
new file mode 100644
index 0000000..31e117e
--- /dev/null
+++ b/collectors/python.d.plugin/fail2ban/Makefile.inc
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+# THIS IS NOT A COMPLETE Makefile
+# IT IS INCLUDED BY ITS PARENT'S Makefile.am
+# IT IS REQUIRED TO REFERENCE ALL FILES RELATIVE TO THE PARENT
+
+# install these files
+dist_python_DATA       += fail2ban/fail2ban.chart.py
+dist_pythonconfig_DATA += fail2ban/fail2ban.conf
+
+# do not install these files, but include them in the distribution
+dist_noinst_DATA       += fail2ban/README.md fail2ban/Makefile.inc
+
diff --git a/collectors/python.d.plugin/fail2ban/README.md b/collectors/python.d.plugin/fail2ban/README.md
new file mode 100644
index 0000000..2651198
--- /dev/null
+++ b/collectors/python.d.plugin/fail2ban/README.md
@@ -0,0 +1,25 @@
+# fail2ban
+
+Module monitor fail2ban log file to show all bans for all active jails
+
+**Requirements:**
+ * fail2ban.log file MUST BE readable by netdata (A good idea is to add  **create 0640 root netdata** to fail2ban conf at logrotate.d)
+
+It produces one chart with multiple lines (one line per jail)
+
+### configuration
+
+Sample:
+
+```yaml
+local:
+ log_path: '/var/log/fail2ban.log'
+ conf_path: '/etc/fail2ban/jail.local'
+ exclude: 'dropbear apache'
+```
+If no configuration is given, module will attempt to read log file at `/var/log/fail2ban.log` and conf file at `/etc/fail2ban/jail.local`.
+If conf file is not found default jail is `ssh`.
+
+---
+
+[![analytics](https://www.google-analytics.com/collect?v=1&aip=1&t=pageview&_s=1&ds=github&dr=https%3A%2F%2Fgithub.com%2Fnetdata%2Fnetdata&dl=https%3A%2F%2Fmy-netdata.io%2Fgithub%2Fcollectors%2Fpython.d.plugin%2Ffail2ban%2FREADME&_u=MAC~&cid=5792dfd7-8dc4-476b-af31-da2fdb9f93d2&tid=UA-64295674-3)]()
diff --git a/collectors/python.d.plugin/fail2ban/fail2ban.chart.py b/collectors/python.d.plugin/fail2ban/fail2ban.chart.py
new file mode 100644
index 0000000..dfd2fea
--- /dev/null
+++ b/collectors/python.d.plugin/fail2ban/fail2ban.chart.py
@@ -0,0 +1,206 @@
+# -*- coding: utf-8 -*-
+# Description: fail2ban log netdata python.d module
+# Author: l2isbad
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+import re
+import os
+
+from collections import defaultdict
+from glob import glob
+
+from bases.FrameworkServices.LogService import LogService
+
+
+ORDER = [
+    'jails_bans',
+    'jails_in_jail',
+]
+
+
+def charts(jails):
+    """
+    Chart definitions creating
+    """
+
+    ch = {
+        ORDER[0]: {
+                'options': [None, 'Jails Ban Rate', 'bans/s', 'bans', 'jail.bans', 'line'],
+                'lines': []
+        },
+        ORDER[1]: {
+                'options': [None, 'Banned IPs (since the last restart of netdata)', 'IPs', 'in jail',
+                            'jail.in_jail', 'line'],
+                'lines': []
+        },
+    }
+    for jail in jails:
+        dim = [
+            jail,
+            jail,
+            'incremental',
+        ]
+        ch[ORDER[0]]['lines'].append(dim)
+
+        dim = [
+            '{0}_in_jail'.format(jail),
+            jail,
+            'absolute',
+        ]
+        ch[ORDER[1]]['lines'].append(dim)
+
+    return ch
+
+
+RE_JAILS = re.compile(r'\[([a-zA-Z0-9_-]+)\][^\[\]]+?enabled\s+= (true|false)')
+
+# Example:
+# 2018-09-12 11:45:53,715 fail2ban.actions[25029]: WARNING [ssh] Unban 195.201.88.33
+# 2018-09-12 11:45:58,727 fail2ban.actions[25029]: WARNING [ssh] Ban 217.59.246.27
+# 2018-09-12 11:45:58,727 fail2ban.actions[25029]: WARNING [ssh] Restore Ban 217.59.246.27
+RE_DATA = re.compile(r'\[(?P<jail>[A-Za-z-_0-9]+)\] (?P<action>Unban|Ban|Restore Ban) (?P<ip>[a-f0-9.:]+)')
+
+DEFAULT_JAILS = [
+    'ssh',
+]
+
+
+class Service(LogService):
+    def __init__(self, configuration=None, name=None):
+        LogService.__init__(self, configuration=configuration, name=name)
+        self.order = ORDER
+        self.definitions = dict()
+        self.log_path = self.configuration.get('log_path', '/var/log/fail2ban.log')
+        self.conf_path = self.configuration.get('conf_path', '/etc/fail2ban/jail.local')
+        self.conf_dir = self.configuration.get('conf_dir', '/etc/fail2ban/jail.d/')
+        self.exclude = self.configuration.get('exclude', str())
+        self.monitoring_jails = list()
+        self.banned_ips = defaultdict(set)
+        self.data = dict()
+
+    def check(self):
+        """
+        :return: bool
+        """
+        if not self.conf_path.endswith(('.conf', '.local')):
+            self.error('{0} is a wrong conf path name, must be *.conf or *.local'.format(self.conf_path))
+            return False
+
+        if not os.access(self.log_path, os.R_OK):
+            self.error('{0} is not readable'.format(self.log_path))
+            return False
+
+        if os.path.getsize(self.log_path) == 0:
+            self.error('{0} is empty'.format(self.log_path))
+            return False
+
+        self.monitoring_jails = self.jails_auto_detection()
+        for jail in self.monitoring_jails:
+            self.data[jail] = 0
+            self.data['{0}_in_jail'.format(jail)] = 0
+
+        self.definitions = charts(self.monitoring_jails)
+        self.info('monitoring jails: {0}'.format(self.monitoring_jails))
+
+        return True
+
+    def get_data(self):
+        """
+        :return: dict
+        """
+        raw = self._get_raw_data()
+
+        if not raw:
+            return None if raw is None else self.data
+
+        for row in raw:
+            match = RE_DATA.search(row)
+
+            if not match:
+                continue
+
+            match = match.groupdict()
+
+            if match['jail'] not in self.monitoring_jails:
+                continue
+
+            jail, action, ip = match['jail'], match['action'], match['ip']
+
+            if action == 'Ban' or action == 'Restore Ban':
+                self.data[jail] += 1
+                if ip not in self.banned_ips[jail]:
+                    self.banned_ips[jail].add(ip)
+                    self.data['{0}_in_jail'.format(jail)] += 1
+            else:
+                if ip in self.banned_ips[jail]:
+                    self.banned_ips[jail].remove(ip)
+                    self.data['{0}_in_jail'.format(jail)] -= 1
+
+        return self.data
+
+    def get_files_from_dir(self, dir_path, suffix):
+        """
+        :return: list
+        """
+        if not os.path.isdir(dir_path):
+            self.error('{0} is not a directory'.format(dir_path))
+            return list()
+
+        return glob('{0}/*.{1}'.format(self.conf_dir, suffix))
+
+    def get_jails_from_file(self, file_path):
+        """
+        :return: list
+        """
+        if not os.access(file_path, os.R_OK):
+            self.error('{0} is not readable or not exist'.format(file_path))
+            return list()
+
+        with open(file_path, 'rt') as f:
+            lines = f.readlines()
+            raw = ' '.join(line for line in lines if line.startswith(('[', 'enabled')))
+
+        match = RE_JAILS.findall(raw)
+        # Result: [('ssh', 'true'), ('dropbear', 'true'), ('pam-generic', 'true'), ...]
+
+        if not match:
+            self.debug('{0} parse failed'.format(file_path))
+            return list()
+
+        return match
+
+    def jails_auto_detection(self):
+        """
+        :return: list
+
+        Parses jail configuration files. Returns list of enabled jails.
+        According man jail.conf parse order must be
+        * jail.conf
+        * jail.d/*.conf (in alphabetical order)
+        * jail.local
+        * jail.d/*.local (in alphabetical order)
+        """
+        jails_files, all_jails, active_jails = list(), list(), list()
+
+        jails_files.append('{0}.conf'.format(self.conf_path.rsplit('.')[0]))
+        jails_files.extend(self.get_files_from_dir(self.conf_dir, 'conf'))
+        jails_files.append('{0}.local'.format(self.conf_path.rsplit('.')[0]))
+        jails_files.extend(self.get_files_from_dir(self.conf_dir, 'local'))
+
+        self.debug('config files to parse: {0}'.format(jails_files))
+
+        for f in jails_files:
+            all_jails.extend(self.get_jails_from_file(f))
+
+        exclude = self.exclude.split()
+
+        for name, status in all_jails:
+            if name in exclude:
+                continue
+
+            if status == 'true' and name not in active_jails:
+                active_jails.append(name)
+            elif status == 'false' and name in active_jails:
+                active_jails.remove(name)
+
+        return active_jails or DEFAULT_JAILS
diff --git a/collectors/python.d.plugin/fail2ban/fail2ban.conf b/collectors/python.d.plugin/fail2ban/fail2ban.conf
new file mode 100644
index 0000000..a36436b
--- /dev/null
+++ b/collectors/python.d.plugin/fail2ban/fail2ban.conf
@@ -0,0 +1,68 @@
+# netdata python.d.plugin configuration for fail2ban
+#
+# This file is in YaML format. Generally the format is:
+#
+# name: value
+#
+# There are 2 sections:
+#  - global variables
+#  - one or more JOBS
+#
+# JOBS allow you to collect values from multiple sources.
+# Each source will have its own set of charts.
+#
+# JOB parameters have to be indented (using spaces only, example below).
+
+# ----------------------------------------------------------------------
+# Global Variables
+# These variables set the defaults for all JOBs, however each JOB
+# may define its own, overriding the defaults.
+
+# update_every sets the default data collection frequency.
+# If unset, the python.d.plugin default is used.
+# update_every: 1
+
+# priority controls the order of charts at the netdata dashboard.
+# Lower numbers move the charts towards the top of the page.
+# If unset, the default for python.d.plugin is used.
+# priority: 60000
+
+# penalty indicates whether to apply penalty to update_every in case of failures.
+# Penalty will increase every 5 failed updates in a row. Maximum penalty is 10 minutes.
+# penalty: yes
+
+# autodetection_retry sets the job re-check interval in seconds.
+# The job is not deleted if check fails.
+# Attempts to start the job are made once every autodetection_retry.
+# This feature is disabled by default.
+# autodetection_retry: 0
+
+# ----------------------------------------------------------------------
+# JOBS (data collection sources)
+#
+# The default JOBS share the same *name*. JOBS with the same name
+# are mutually exclusive. Only one of them will be allowed running at
+# any time. This allows autodetection to try several alternatives and
+# pick the one that works.
+#
+# Any number of jobs is supported.
+#
+# All python.d.plugin JOBS (for all its modules) support a set of
+# predefined parameters. These are:
+#
+# job_name:
+#     name: myname            # the JOB's name as it will appear at the
+#                             # dashboard (by default is the job_name)
+#                             # JOBs sharing a name are mutually exclusive
+#     update_every: 1         # the JOB's data collection frequency
+#     priority: 60000         # the JOB's order on the dashboard
+#     penalty: yes            # the JOB's penalty
+#     autodetection_retry: 0  # the JOB's re-check interval in seconds
+#
+# Additionally to the above, fail2ban also supports the following:
+#
+#     log_path:  'path to fail2ban.log'			                 # Default: '/var/log/fail2ban.log'
+#     conf_path: 'path to jail.local/jail.conf'			         # Default: '/etc/fail2ban/jail.local'
+#     conf_dir:  'path to jail.d/'			                     # Default: '/etc/fail2ban/jail.d/'
+#     exclude:   'jails you want to exclude from autodetection'  # Default: none
+#------------------------------------------------------------------------------------------------------------------