Differences

This shows you the differences between two versions of the page.

--- сервис_fail2ban [2020/11/17 16:28]
val [Интеграция fail2ban и cisco log]
+++ сервис_fail2ban [2021/02/23 15:56]
val [Интеграция fail2ban и snort]
@@ Line 93: / Line 93: @@
 maxretry    = 1
 logpath     = /var/log/auth.log
+#action      = mail-admin
 #action      = iptables-allports-forward
 #action      = cisco-acl
@@ Line 98: / Line 99: @@
 # cat /etc/fail2ban/filter.d/snort_filter.conf
 </code><code>
-[INCLUDES]
 [Definition]
 failregex = .*snort.*Priority: 1.*} <HOST>.*
 #        .*snort.*Priority: 2.*} <HOST>.*
+</code>
+==== Уведомление по email ====
+<code>
+# cat /etc/fail2ban/action.d/mail-admin.conf
+</code><code>
+[Definition]
+actionban = printf %%b "Hi,\n
+            Ban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Ban <name> <ip>" <dest>
+actionunban = printf %%b "Hi,\n
+            Unban this <ip>
+            Regards,\n
+            Fail2Ban"|mail -s "[Fail2Ban] Unban <name> <ip>" <dest>
+[Init]
+name = mail-admin
-ignoreregex =
+dest = student
 </code>
@@ Line 174: / Line 194: @@
 actionban = /root/cisco-change-firewall.sh
-actionunban = /root/cisco-change-firewall.sh
+# f2b bug
+actionunban = echo /root/cisco-change-firewall.sh | at now + 1 min
 </code>

Методические материалы Лохтурова Вячеслава