fail2ban-from-s3

Grabs a JSON-encoded list of things to ban and bans them using fail2ban.

Installation

python -m pip install --upgrade fail2ban-importer

Usage

fail2ban-importer [--oneshot|--dryrun]

Configuration

The following paths will be tested (in order) and the first one loaded:

• ./fail2ban-importer.json
• /etc/fail2ban-importer.json
• ~/.config/fail2ban-importer.json

Fields

Note the fail2ban_jail field. If you're going to pick up your logs from fail2ban, and use them for the source of automation, make sure to filter out the actions by this system - otherwise you'll end up in a loop!

HTTP(S) Source

x
{
    "source": "https://example.com/fail2ban.json",
    "fail2ban_client": "/usr/bin/fail2ban-client",
    "fail2ban_jail" : "automated",
    "schedule_mins" : 15
}

S3-compatible Source

You can use the usual boto3 AWS configuration, or put the options in the config file.

{
    "source": "s3://my-magic-fail2ban-bucket/fail2ban.json",
    "AWS_ACCESS_KEY_ID" : "exampleuser",
    "AWS_SECRET_ACCESS_KEY" : "hunter2",
    "schedule_mins" : 1
}

If you're using minio as your backend, you should add the following additional options to the config file:

{
    "s3_v4" : true,
    "s3_endpoint" : "https://example.com",
}

Example source data file

[
  {
    "jail": "sshd",
    "ip": "196.30.15.254"
  },
  {
    "jail": "sshd",
    "ip": "119.13.89.28"
  }
]

Thanks

• fail2ban
• boto3
• requests
• schedule