12

If the server is restarted, or even if fail2ban is stopped/start it sends a notification.

[asterisk-iptables]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
logpath  = /var/log/asterisk/messages
maxretry = 5
bantime = 259200

Removing the sendmail-whois stops it, but it also stops the ban notifications, how can I get it to stop notifying me when the process starts/stops?

Thanks

10

Have a look in the action.d/mail.conf or action.d/sendmail.conf which control the mail for start/stop/ban.

  • this doesn't do the trick. I think there are some others files to edit because I keep getting this annoying email :( – Kreker May 9 '12 at 7:25
  • @Kreker It worked for me and the OP that's presumably why they marked it as accepted. If it doesn't work for you, perhaps you have a different configuration or you mis-configured something? – Iain May 9 '12 at 8:06
  • In the fail2ban's config I'm using sendmail as mta so it loaded the action.d/sendmail.conf. I have a normal installation from apt-get – Kreker May 9 '12 at 8:25
9

Its not necessary to fix this in any file. It depends on your configuration in jail.conf.

If you configured mta = sendmail, you can narrow the files action.d/sendmail-*.

Then you have to look at your action = %(action_*)s. If you configured

"action_": comment "actionstart" & "actionstop" in action.d/sendmail.conf

"action_mw": comment ... in action.d/sendmail-whois.conf

"action_mwl": comment ... in action.d/sendmail-whois-lines.conf

If you configured mta to "mail", then just change sendmail to mail and configure the specific file.

Dont forget to restart after commenting the file!

7

The only way I found to disable the start/stop notifications was to comment out the actionstart and actionstop sections in all of these files in action.d/:

mail-buffered.conf
mail.conf
mail-whois.conf
mail-whois-lines.conf
sendmail-buffered.conf
sendmail.conf
sendmail-whois.conf
sendmail-whois-lines.conf
6

To fix this on Fail2Ban v0.9.1 (from the epel repository) on CentOS 7 (RHEL 7) you can override the sendmail start and stop actions (set them to nothing) in /etc/fail2ban/action.d/sendmail-common.local. I create this file by running these commands as root:

cat << EOF >> /etc/fail2ban/action.d/sendmail-common.local
# Override the Fail2Ban defaults in sendmail-common.conf with these entries

[Definition]
# Disable email notifications of jails stopping or starting
actionstart =
actionstop =
EOF
cat /etc/fail2ban/action.d/sendmail-common.local
  • This does not actually help to solve the problem, since the .local variant will be loaded after the .conf file, but both will still be loaded before the definitions in the (send)mail-*.conf files configuring the actions. There is no other way than editing the action files, the cleanest/most minimalist being to add an after hook in those files pointing to the same include. Cf. osso.nl/blog/fail2ban-started-e-mail-disable. You could also duplicate all those files and create a complete other branch, i.e. custommail-*.conf, which avoids modifying default files. – Bernard Rosset Mar 17 '17 at 13:07
  • In centOS7, this was the only advise that actually helped. sure, the next fail2ban restart will still trigger the stop jails notification(s), but not the start one(s). Then new conf is loaded and so neither the stop notifications will be triggered again – lese Jul 18 '17 at 15:16
  • @BernardRosset This really does work, but it requires fail2ban 0.9 or higher and that someone hasn't modified the shipped configuration files and has confined their changes to .local files. Everything in 0.9 can be overridden from .local files, but this wasn't true in 0.8 and prior. – Michael Hampton Oct 25 '18 at 16:58
3

Trying to put together the bits and pieces of the previous answers, with some more details and long commands for the lazy.

Your jail.{conf,local} defines how mails are sent. By default, it is sendmail. Check with:

grep 'mta *=' jail.{conf,local}

To see which start/stop actions are configured for your jails, use fail2ban-client -d.

Putting both together:

mta=$(grep 'mta *=' /etc/fail2ban/jail.{conf,local} | awk '{print $NF}')
fail2ban-client -d | awk "/action(start|stop).*$mta/ {print \$4}" | sort -u

In my config, the output is 'sendmail-whois-lines', so that is the file to edit. Assuming your config is under /etc/fail2ban, the full file name is /etc/fail2ban/action.d/sendmail-whois-lines.conf.

However, as Rabin mentions, do not edit that file directly, because it will be overwritten during updates. Instead, create /etc/fail2ban/action.d/sendmail-whois-lines.local (or whatever action.d/file-name.local is right in your config) and add these lines:

[Definition]
actionstart =
actionstop  =

Or, for the really lazy who cannot be bothered with looking up and creating the right file:

mta=$(grep 'mta *=' /etc/fail2ban/jail.{conf,local} | awk '{print $NF}')
fail2ban-client -d \
| awk "/action(start|stop).*$mta/ {print \$4}" \
| sort -u \
| while read f; do \
    f=${f//\'/}
    f="/etc/fail2ban/action.d/${f/%,/}.local"
    cat <<EOF >>"$f"
[Definition]
actionstart =
actionstop  =
EOF
done
1

Override actionstart and actionstop definitions in /etc/fail2ban/action.d/sendmail-common.conf by creating a file /etc/fail2ban/action.d/sendmail-common.local.

Add the text below to this file

[Definition]
actionstart =
actionstop =

Now you are not getting any mail on start / stop of the fail2ban service.

  • Worth pointing out that you need to make sure the permissions are set properly on the file (i.e 0644 and owned by root). This bit me today. – Pezholio Sep 27 '17 at 14:30
0

I found a quick and easy way to do this:

cd into your /etc/fail2ban/action.d directory.

Then simply supersede each actionstart statement with your own, which for me was blank.

for FILE in *mail* ; do echo -e "actionstart =\nactionstop =\n" >> $FILE ; done

This will append a new actionstart and actionstop section to each file that mails out.

1 line, job done.

0

I don't recommend changing the default files which comes with the package (as some suggested here), they will be overwritten next time you update them.

Just copy the action your using in that case sendmail-whois to a new file, name it as you like e.g sendmail-mod and in this file you need to comment out (or delete) the actionstart/actionstop parts.

Next change the action in the configuration file (jail.conf/jail.local), to use the new action.

From:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 

To:

action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-mod[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.