mbelloiseau/fail2ban-mattermost-notifications

Receive Mattermost notifications when Fail2ban triggers an action (ban, unban, start, stop)

fail2ban-mattermost-notifications

Receive Mattermost notifications when Fail2ban triggers an action (ban, unban, start, stop)

Requirements

• curl
• geoiplookup

Usage

• Copy mattermost.sh (/opt/scripts/mattermost.sh for example) and set your webhook url (line 3)
• Copy mattermost.conf into /etc/fail2ban/action.d and set the right script location
• Update your jails and include the mattermost action

Example with the Nginx jail

[nginx-http-auth]
enabled = true
port    = http,https
logpath = %(nginx_error_log)s
action = ufw
         mattermost

That's it !

fail2ban-mattermost-notifications's Issues

Does this still work and does the server have to be local?

Follow your steps including plugging in my webhook url.

Nothing is working. Swag log looks clean

Testing with Vaultwarden logs (See bottom rows of jails config)

I have my vaultwarden log mounted at /logs/bitwarden/vaultwarden.log and Sonarr at /logs/sonarr/sonarr.txt

My Jails file

## Version 2020/05/10 - Changelog: https://github.com/linuxserver/docker-swag/commits/master/root/defaults/jail.local
# This is the custom version of the jail.conf for fail2ban
# Feel free to modify this and add additional filters
# Then you can drop the new filter conf files into the fail2ban-filters
# folder and restart the container

[DEFAULT]

# Changes the default ban action from "iptables-multiport", which causes issues on some platforms, to "iptables-allports".
banaction = iptables-allports

# "bantime" is the number of seconds that a host is banned.
bantime  = 600

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 600

# "maxretry" is the number of failures before a host get banned.
maxretry = 5


[ssh]

enabled = false


[nginx-http-auth]

enabled  = true
filter   = nginx-http-auth
port     = http,https
logpath  = /config/log/nginx/error.log
#action =  mattermost

[nginx-badbots]

enabled  = true
port     = http,https
filter   = nginx-badbots
logpath  = /config/log/nginx/access.log
maxretry = 2
#action = mattermost

[nginx-botsearch]

enabled  = true
port     = http,https
filter   = nginx-botsearch
logpath  = /config/log/nginx/access.log
#action =  mattermost

[nginx-deny]
enabled  = true
port     = http,https
filter   = nginx-deny
logpath  = /config/log/nginx/error.log
#action = mattermost

[sonarr]
enabled  = true
filter = sonarr-auth
maxretry = 3
logpath  = /logs/sonarr/sonarr.txt
#action = mattermost


[vaultwarden]
enabled = true
port = 80,443,8081
filter = vaultwarden
logpath = /logs/bitwarden/vaultwarden.log
action = mattermost

[vaultwarden-admin]
enabled = true
port = 80,443,8081
filter = vaultwarden-admin
logpath = /logs/bitwarden/vaultwarden.log
action =  mattermost

View of logs inside swag container

root@7db4dd4e3f23:/logs/bitwarden# ls
2-20  config.json  db.sqlite3  db.sqlite3-shm  db.sqlite3-wal  icon_cache  logs  rsa_key.der  rsa_key.pem  rsa_key.pub.der  rsa_key.pub.pem  vaultwarden.log