Shows geolocation of failed attempts registered by fail2ban
Project description
fail2bangeolocation
Shows geolocation of failed attempts registered by fail2ban.
It's useful to know from which locations you are being attacked the most.
You can group locations by country or by country and by city.
Screenshots
- Grouped by country
- Grouped by country and city
Requirements
- python3
- fail2ban
- python libraries:
- setuptools
- requests
- tqdm
- colorama
Installation
You can install fail2bangeolocation via pip3:
$ pip3 install fail2bangeolocation
You also can run fail2bangeolocation directly without installing it, but you need to install the dependencies manually:
$ sudo pip3 install -r requirements.txt
Usage
-
If you installed fail2bangeolocation with pip3 you can run it directly from the command line interface:
$ fail2bangeolocation [-h] [-c] {fail2ban,log,server}
-
You can run fail2bangeolocation without installation running the fail2bangeolocation.py script
$ ./fail2bangeolocation.py [-h] [-c] {fail2ban,log,server}
or
$ python3 fail2bangeolocation.py [-h] [-c] {fail2ban,log,server}
-
fail2bangeolocation arguments
usage: fail2bangeolocation.py [-h] [-c] {fail2ban,log,server} ... Shows geolocation of failed attempts registered by fail2ban positional arguments: {fail2ban,log,server} These options are mutually exclusive fail2ban analyze all banned IPs by fail2ban log analyze a fail2ban log file. Use "log -h" to see more options server analyze all banned IPs by fail2ban (e.g. "server sshd") optional arguments: -h, --help show this help message and exit -c, --show-city group IPs by country and city
-
Analyze all IPs registered by fail2ban
:warning: Requires root privileges
Run fail2bangeolocation using the fail2ban argument:
$ sudo fail2bangeolocation fail2ban
-
Analyze all IPs registered by fail2ban for a given jailed server/service, e.g. sshd
:warning: Requires root privileges
Run fail2bangeolocation with the server argument and the jailed server name:$ sudo fail2bangeolocation server sshd
-
Analyze a log file
:warning: May require root privileges depending on the file to be analyzed
Run fail2bangeolocation with the log argument and the path to the log file:$ fail2bangeolocation log /var/log/fai2ban.log
You can also geolocate the unbanned IPs contained in the log adding the -u argument:
$ fail2bangeolocation log -u /var/log/fai2ban.log
-
Group the output by country and city
Run fail2bangeolocation with "-c" as first argument:
$ fail2bangeolocation -c {fail2ban,log,server}
Troubleshooting
In case of any problem create an issue
Discussions
If you want ask (or answer) a question, leave an opinion or have an open-ended conversation you can create (or join) a discussion
Support
If you find this application useful you can star this repo.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for fail2bangeolocation-1.0.1.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | 355127e7da265773f9428ddd1da8d97704ee37568b04fc249000450da839c1c1 |
|
MD5 | 93d8f1abf6061c66491cef1839d92203 |
|
BLAKE2b-256 | 0e2b63582c7b43644fb09a2248ad43e451b95ff62f7d64f021e128f5069e9e24 |
Hashes for fail2bangeolocation-1.0.1-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | e238472f2408d0f0f7136feefae826bc5558f1d2f95639aec645c5f2174aead4 |
|
MD5 | 51e6fb71d98a855569bb40943a826721 |
|
BLAKE2b-256 | 6daf4b82ada920b0d4a78bdc93b2a22819b6306bea4b33261a1d1e8eaa4e2333 |