#!/bin/bash # Author : cybergavin # Date : 28-FEB-2020 # Description : This script is executed when Fail2Ban takes action to ban an IP. The script # logs the time, IP being banned and the reason for banning and such data will # facilitate decisions on permanent blacklisting of IPs. # ###################################################################################################### # # Variables # sender_name="cybergavin" sender_email="mail@cybergav.in" rec_email="" # Multiple email adddresses may be used and separated with commas valid_user_bantime=`fail2ban-client get sshd-valid bantime` # # Determine Script Location # if [ -n "`dirname $0 | grep '^/'`" ]; then SCRIPT_LOCATION=`dirname $0` elif [ -n "`dirname $0 | grep '^..'`" ]; then cd `dirname $0` SCRIPT_LOCATION=$PWD cd - > /dev/null else SCRIPT_LOCATION=`echo ${PWD}/\`dirname $0\` | sed 's#\/\.$##g'` fi # # Log stderr and stdout # exec 1> ${SCRIPT_LOCATION}/banaction.stdout exec 2> ${SCRIPT_LOCATION}/banaction.stderr # # Parse input # unset myip myuser if [ $# -eq 0 ]; then printf "ERROR : Invalid script usage.\nUSAGE: /etc/fail2ban/banaction.sh -i -u -f " exit 1 else while getopts ":i:u:f:" opt; do case $opt in i ) myip=${OPTARG} ;; u ) myuser=${OPTARG} ;; f ) myfails=${OPTARG} ;; : ) printf "\n$0: Missing argument for -$OPTARG option\n" exit 2 ;; \? ) printf "ERROR : Invalid script usage.\nUSAGE: /etc/fail2ban/banaction.sh -i -u -f " exit 1 ;; esac done shift $(($OPTIND - 1)) fi # # Send email alert if the user is valid # if [ -n "`id -un $myuser`" ]; then cat < To: $rec_email Content-Type: text/html The XXXYYY Application has been protected by Fail2Ban as per the following:

Hostname	$HOSTNAME
Banned IP	$myip
User	$myuser
#Failures	$myfails
Ban Duration	$(( valid_user_bantime/60 )) minutes

NOTE:To unban the above IP address, login on $HOSTNAME as esuser and execute the following command:

sudo fail2ban-client set sshd-valid unbanip $myip EOF fi # # Log Fail2Ban data # if [ ! -d ${SCRIPT_LOCATION}/data ]; then mkdir ${SCRIPT_LOCATION}/data fi DATAFILE=${SCRIPT_LOCATION}/data/banaction_`date '+%b%Y'`.csv TDATE=`date '+%Y-%m-%d'` TTIME=`date '+%H:%M:%S'` if [ ! -f $DATAFILE ]; then echo "DATE,TIME,BANNED IP,USER" > $DATAFILE echo "${TDATE},${TTIME},${myip},${myuser}" >> $DATAFILE else echo "${TDATE},${TTIME},${myip},${myuser}" >> $DATAFILE fi # # Housekeep # if [ -d ${SCRIPT_LOCATION}/data ]; then find ${SCRIPT_LOCATION}/data -type f -name "banaction*.csv" -mtime +180 | xargs rm -f fi