Slack notifications for Fail2Ban(blog.coleturner.me)
blog.coleturner.me
Slack notifications for Fail2Ban
http://blog.coleturner.me/post/138894760556/slack-notifications-for-fail2ban
13 comments
On my very insignificant server, fail2ban has banned around 400 IP addresses in 2016, so far. What actionable information would I have received by having a disruptive notification about it?
I have them in a quiet channel without notifications just to amuse myself. I have not nearly that much tho
I agree, what I do instead is track the number of currently banned with nagios and if it goes over a specific threshold I get a warning. With PNP4Nagios you also get a nice graph over time.
None. It is the attacks that don't get banned that you want to know about.
On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?
On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?
For new IP addresses, you can write a script to monitor your auth.log file.
Good idea. I'd rather see it use something standard like XMPP and then people can connect it to propriety apps like slack if they so wish.
Thanks! I know there are better protocols out there to handle this sort of thing, but I'm already using Slack and used this protocol because it fit my own needs and it requires less dependencies to fit those needs.
But that wouldn't get the buzz and attention of the latest techno fanboy circle jerk.
I agree completely that these things should use open standards first, and possibly support closed/app specific protocols/Apis second, if said app doesn't support an open standard.
But that doesn't work for a lot of devs these days, because it's not an instant popularity contest winner
I agree completely that these things should use open standards first, and possibly support closed/app specific protocols/Apis second, if said app doesn't support an open standard.
But that doesn't work for a lot of devs these days, because it's not an instant popularity contest winner
couldn't agree more
I did something similar a while back but used a PHP script to send the notifications to Slack: https://savjee.be/2015/09/Sending-fail2ban-notifications-and...
Well OK, but I'm not sure I get the point.
Surely just feed all logs into Splunk or Logstash or similar? Most monitoring systems have plugins to alert via Slack now.
Surely just feed all logs into Splunk or Logstash or similar? Most monitoring systems have plugins to alert via Slack now.