Advanced fail2ban parameters in filter/action

Question

I have fail2ban running to protect our freeswitch servers against attack. When an IP address has too many failed logins, it gets banned. I'd like to get notification of which account is being attacked - not just the IP address.

So a log line might be

2015-09-11 08:27:40.212155 [WARNING] sofia_reg.c:1477 SIP auth failure (REGISTER) on sofia profile 'internal' for [[email protected]@004-2025.sb12.dmclub.org] from ip 78.31.75.181

I would like an email sent (or some php script run) that includes the [[email protected]@004-2025.sb12.dmclub.org] bit (or even just the whole line)

Is that possible?

My guess is that it isn't, just due to the flow of data from many rows with a common host, so I'm not holding my breath! ;-)

Stack Overflow is for programming questions; questions about non-programming tools like firewalls, etc. are off-topic. You may want to check if your question is on-topic on Server Fault or Super User instead. — Colonel Thirty Two

Unknown Unknown · Accepted Answer · 2015-09-18T18:33:17

If you configure fail2ban to use the action_mwl Action Shortcut, it will send you a mail with whois information and the full log line.

In /etc/fail2ban/jail.conf, make sure the action setting is set to:

action = %(action_mwl)s

Advanced fail2ban parameters in filter/action

1 Answers