fail2ban-from-s3

Grabs a JSON-encoded list of things to ban and bans them using fail2ban.

Configuration

Config file can be in one of the following paths:

• ./fail2ban_importer.json
• ~/.config/fail2ban_importer.json
• /etc/fail2ban_importer.json

Fields

HTTPS Source

{
    "source": "https://example.com/fail2ban.json",
    "jail_field": "service",
    "jail_target": "src",
    "fail2ban_client": "/usr/bin/fail2ban-client",
    "schedule_mins" : 1
}

S3-compatible Source

You can use the usual boto3 AWS configuration, or put the options in the config file.

{
    "source": "s3://my-magic-fail2ban-bucket/fail2ban.json",
    "AWS_ACCESS_KEY_ID" : "exampleuser",
    "AWS_SECRET_ACCESS_KEY" : "hunter2",
    "jail_field": "service",
    "jail_target": "src",
    "schedule_mins" : 1
}

If you're using minio as your backend, you should add the following additional options to the config file:

{
    "s3_v4" : true,
    "s3_endpoint" : "https://example.com",
}

Example source data file

[
  {
    "ban_time": "1640997884.011",
    "host": "host1.example.com",
    "service": "sshd",
    "src": "196.30.15.254"
  },
  {
    "ban_time": "1640996178.501",
    "host": "host2.example.com",
    "service": "https",
    "src": "119.13.89.28"
  }
]

Thanks

• fail2ban
• boto3
• requests
• schedule