A
A
Al2020-01-30 18:36:32
linux
Al, 2020-01-30 18:36:32

How to force fail2ban to execute bash script during ban?

I have jail.local, after three unsuccessful attempts to enter the phpmyadmin web interface, access to the server is blocked:

[phpmyadmin]
enabled = true
maxretry = 3
port = http,https
filter = phpmyadmin
logpath = /var/log/apache2/phpmyadmin/access.log
action = iptables-multiport[name=phpmyadmin, port="http,https", protocol=tcp]

Everything is working properly. I decided that I need to notify me when someone gets into the ban list, for this I wrote a script that will make an http request do-req.sh:
#!/bin/bash
while getopts t: option
do
 case $option in
;;
 t)
  TEXT=${OPTARG}
;;
 esac
done
POST_DATA="{\""text"\":"\"$TEXT"\"}";
URL="http://localhost/fail";
wget -O- --header="Content-Type: application/json" --post-data $POST_DATA --no-check-certificate $URL;

Checked the script is working.
Next, in the action.d folder, I created the iptables-multiport-exec.conf config:
[INCLUDES]
before = iptables-multiport.conf
[Definition]
actionban = /etc/fail2ban/scripts/do-req.sh -t ban_detected
[Init]

Changed action in jail.local:
action = iptables-multiport-exec[name=phpmyadmin, port="http,https", protocol=tcp]


But, all this does not work, fail2ban starts, writes ip-addresses to the ban list, but access for them remains open.
How to solve such a problem correctly? As if the script that is described here is not being executed: before = iptables-multiport.conf

Answer the question

In order to leave comments, you need to log in

2 answer(s)
A
Andrey Barbolin, 2020-01-30
@dronmaxman

https://technicalramblings.com/blog/how-to-add-ema...

V
Vadim Priluzkiy, 2020-01-30
@Oxyd

actionban = /bin/sh -c /etc/fail2ban/scripts/do-req.sh -t ban_detected

So it doesn't work?

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question