Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If the server is restarted, or even if fail2ban is stopped/start it sends a notification.

[asterisk-iptables]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
logpath  = /var/log/asterisk/messages
maxretry = 5
bantime = 259200

Removing the sendmail-whois stops it, but it also stops the ban notifications, how can I get it to stop notifying me when the process starts/stops?

Thanks

share|improve this question

5 Answers 5

up vote 5 down vote accepted

Have a look in the action.d/mail.conf or action.d/sendmail.conf which control the mail for start/stop/ban.

share|improve this answer
    
this doesn't do the trick. I think there are some others files to edit because I keep getting this annoying email :( –  Kreker May 9 '12 at 7:25
    
@Kreker It worked for me and the OP that's presumably why they marked it as accepted. If it doesn't work for you, perhaps you have a different configuration or you mis-configured something? –  Iain May 9 '12 at 8:06
    
In the fail2ban's config I'm using sendmail as mta so it loaded the action.d/sendmail.conf. I have a normal installation from apt-get –  Kreker May 9 '12 at 8:25

The only way I found to disable the start/stop notifications was to comment out the actionstart and actionstop sections in all of these files in action.d/:

mail-buffered.conf
mail.conf
mail-whois.conf
mail-whois-lines.conf
sendmail-buffered.conf
sendmail.conf
sendmail-whois.conf
sendmail-whois-lines.conf
share|improve this answer

Its not necessary to fix this in any file. It depends on your configuration in jail.conf.

If you configured mta = sendmail, you can narrow the files action.d/sendmail-*.

Then you have to look at your action = %(action_*)s. If you configured

"action_": comment "actionstart" & "actionstop" in action.d/sendmail.conf

"action_mw": comment ... in action.d/sendmail-whois.conf

"action_mwl": comment ... in action.d/sendmail-whois-lines.conf

If you configured mta to "mail", then just change sendmail to mail and configure the specific file.

Dont forget to restart after commenting the file!

share|improve this answer

I found a quick and easy way to do this:

cd into your /etc/fail2ban/action.d directory.

Then simply supersede each actionstart statement with your own, which for me was blank.

for FILE in *mail* ; do echo -e "actionstart =\nactionstop =\n" >> $FILE ; done

This will append a new actionstart and actionstop section to each file that mails out.

1 line, job done.

share|improve this answer

I don't recommend changing the default files which comes with the package (as some suggested here), they will be overwritten next time you update them.

Just copy the action your using in that case sendmail-whois to a new file, name it as you like e.g sendmail-mod and in this file you need to comment out (or delete) the actionstart/actionstop parts.

Next change the action in the configuration file (jail.conf/jail.local), to use the new action.

From:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 

To:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-mod[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.