In this article, I will show an example of setting up Fail2ban email notifications.
Let’s say there are separate configurations for each service. Let’s open one for SSH, for example, and add one line at the end for “action”:
nano /etc/fail2ban/jail.d/sshd.local
[sshd]
backend = polling
journalmatch=
enabled = true
maxretry = 1
bantime = 90d
#findtime = 12h
filter = sshd
logpath = /var/log/auth.log
#action = iptables-allports
#action = iptables-multiport[name=sshd, port="2222", protocol=tcp]
action = nftables-multiport[name=sshd, port="2222", protocol=tcp]
banned_db[name=sshd, port="2222", protocol=tcp]
%(mta)s[sender="%(sender)s", dest="%(destemail)s"]
To also receive whois information and some from the logs, we’ll change the last line to (the old one can be commented out in case you need to send less information, and by the way, whois takes a few seconds for each IP address):
%(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
Another example of notification + WHOIS (without logs):
%(mta)s-whois[sender="%(sender)s", dest="%(destemail)s"]
Let’s install whois if it is not installed:
apt update
apt install whois
Now let’s say there is a jail.local file:
sudo nano /etc/fail2ban/jail.local
[DEFAULT]
findtime = 12h
bantime = 30d
maxretry = 5
ignoreip = 127.0.0.1 127.0.0.0/8 10.0.0.0/22
If not, then we will create one and add mail parameters at the end (mta can be mail, sendmail, postfix, smtp, etc.):
destemail = [email protected]
sender = [email protected]
mta = sendmail
action = %(action_mwl)s
action_ — simply bans without notifications
action_mw — sends an email with a ban notification
action_mwl — email + log
It’s best not to specify this in the jail.conf file, as it’s the default configuration template and may be overwritten after a fail2ban update. jail.local is your configuration and takes precedence over jail.conf. You can describe everything you need in it, including the required jails, such as sshd, or configure jails in separate files, such as /jail.d/sshd.local.
Once email notifications are set up, let’s add a test IP to the ban and make sure the email is delivered:
fail2ban-client set sshd banip 1.2.3.4
fail2ban-client set sshd unbanip 1.2.3.4
You can also check whether the letter was sent via sendmail, mail, etc.:
echo "Test sendmail" | sendmail -v [email protected]
echo "Test mail" | mail -s "Fail2ban test" [email protected]
See also my article:
Installing and Configuring Fail2ban