0

Is there a way to continue to have Fail2Ban send email notification but disable it for an individual service? I keep getting 100 alerts on sshd and I would like to disable email notifications for sshd and everything else to still send email notifications.

1

https://blog.wturrell.co.uk/how-to-turn-off-fail2ban-email-notifications/

In /etc/fail2ban/jail.conf` there’s a section that describes various actions – look for action_, action_mw and action_mwl. You’ll see they vary in scope, from just writing to the logfile to emailing the sysadmin (or even administrators identified in whois lookups) or automatically banning IPs from 3rd-party services like CloudFlare.

Further down is this:

Choose default action. To change, just override value of 'action' with the

interpolation to the chosen action shortcut (e.g. action_mw, action_mwl, etc) in jail.local

globally (section [DEFAULT]) or per specific section action = %(action_)s

In other words, you can have a single definition in /etc/fail2ban/jail.conf and reuse it in jail.local without writing it out again in full. It will need to go in the correct [section] (or “jail”) or under [DEFAULT].

Remember to restart the service afterwards!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.