Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If the server is restarted, or even if fail2ban is stopped/start it sends a notification.

[asterisk-iptables]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
logpath  = /var/log/asterisk/messages
maxretry = 5
bantime = 259200

Removing the sendmail-whois stops it, but it also stops the ban notifications, how can I get it to stop notifying me when the process starts/stops?

Thanks

share|improve this question
up vote 8 down vote accepted

Have a look in the action.d/mail.conf or action.d/sendmail.conf which control the mail for start/stop/ban.

share|improve this answer
    
this doesn't do the trick. I think there are some others files to edit because I keep getting this annoying email :( – Kreker May 9 '12 at 7:25
    
@Kreker It worked for me and the OP that's presumably why they marked it as accepted. If it doesn't work for you, perhaps you have a different configuration or you mis-configured something? – Iain May 9 '12 at 8:06
    
In the fail2ban's config I'm using sendmail as mta so it loaded the action.d/sendmail.conf. I have a normal installation from apt-get – Kreker May 9 '12 at 8:25

The only way I found to disable the start/stop notifications was to comment out the actionstart and actionstop sections in all of these files in action.d/:

mail-buffered.conf
mail.conf
mail-whois.conf
mail-whois-lines.conf
sendmail-buffered.conf
sendmail.conf
sendmail-whois.conf
sendmail-whois-lines.conf
share|improve this answer

Its not necessary to fix this in any file. It depends on your configuration in jail.conf.

If you configured mta = sendmail, you can narrow the files action.d/sendmail-*.

Then you have to look at your action = %(action_*)s. If you configured

"action_": comment "actionstart" & "actionstop" in action.d/sendmail.conf

"action_mw": comment ... in action.d/sendmail-whois.conf

"action_mwl": comment ... in action.d/sendmail-whois-lines.conf

If you configured mta to "mail", then just change sendmail to mail and configure the specific file.

Dont forget to restart after commenting the file!

share|improve this answer

To fix this on Fail2Ban v0.9.1 (from the epel repository) on CentOS 7 (RHEL 7) you can override the sendmail start and stop actions (set them to nothing) in /etc/fail2ban/action.d/sendmail-common.local. I create this file by running these commands as root:

cat << EOF >> /etc/fail2ban/action.d/sendmail-common.local
# Override the Fail2Ban defaults in sendmail-common.conf with these entries

[Definition]
# Disable email notifications of jails stopping or starting
actionstart =
actionstop =
EOF
cat /etc/fail2ban/action.d/sendmail-common.local
share|improve this answer

I found a quick and easy way to do this:

cd into your /etc/fail2ban/action.d directory.

Then simply supersede each actionstart statement with your own, which for me was blank.

for FILE in *mail* ; do echo -e "actionstart =\nactionstop =\n" >> $FILE ; done

This will append a new actionstart and actionstop section to each file that mails out.

1 line, job done.

share|improve this answer

I don't recommend changing the default files which comes with the package (as some suggested here), they will be overwritten next time you update them.

Just copy the action your using in that case sendmail-whois to a new file, name it as you like e.g sendmail-mod and in this file you need to comment out (or delete) the actionstart/actionstop parts.

Next change the action in the configuration file (jail.conf/jail.local), to use the new action.

From:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 

To:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-mod[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
share|improve this answer

Trying to put together the bits and pieces of the previous answers, with some more details and long commands for the lazy.

Your jail.{conf,local} defines how mails are sent. By default, it is sendmail. Check with:

grep 'mta *=' jail.{conf,local}

To see which start/stop actions are configured for your jails, use fail2ban-client -d.

Putting both together:

mta=$(grep 'mta *=' /etc/fail2ban/jail.{conf,local} | awk '{print $NF}')
fail2ban-client -d | awk "/action(start|stop).*$mta/ {print \$4}" | sort -u

In my config, the output is 'sendmail-whois-lines', so that is the file to edit. Assuming your config is under /etc/fail2ban, the full file name is /etc/fail2ban/action.d/sendmail-whois-lines.conf.

However, as Rabin mentions, do not edit that file directly, because it will be overwritten during updates. Instead, create /etc/fail2ban/action.d/sendmail-whois-lines.local (or whatever action.d/file-name.local is right in your config) and add these lines:

[Definition]
actionstart =
actionstop  =

Or, for the really lazy who cannot be bothered with looking up and creating the right file:

mta=$(grep 'mta *=' /etc/fail2ban/jail.{conf,local} | awk '{print $NF}')
fail2ban-client -d \
| awk "/action(start|stop).*$mta/ {print \$4}" \
| sort -u \
| while read f; do \
    f=${f//\'/}
    f="/etc/fail2ban/action.d/${f/%,/}.local"
    cat <<EOF >>"$f"
[Definition]
actionstart =
actionstop  =
EOF
done
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.