Stop fail2ban stop/start notifications

fail2ban

If the server is restarted, or even if fail2ban is stopped/start it sends a notification.

[asterisk-iptables]
enabled  = true
filter   = asterisk
action   = iptables-allports[name=ASTERISK, protocol=all]
           sendmail-whois[name=ASTERISK, dest=blah@foo.com, sender=blah@foo.com] 
logpath  = /var/log/asterisk/messages
maxretry = 5
bantime = 259200

Removing the sendmail-whois stops it, but it also stops the ban notifications, how can I get it to stop notifying me when the process starts/stops?

Thanks

Best Answer

Have a look in the action.d/mail.conf or action.d/sendmail.conf which control the mail for start/stop/ban.

Related Solutions

Iptables – How to Unban an IP properly with Fail2Ban

With Fail2Ban before v0.8.8:

fail2ban-client get YOURJAILNAMEHERE actionunban IPADDRESSHERE

With Fail2Ban v0.8.8 and later:

fail2ban-client set YOURJAILNAMEHERE unbanip IPADDRESSHERE

The hard part is finding the right jail:

Use iptables -L -n to find the rule name...
...then use fail2ban-client status | grep "Jail list" | sed -E 's/^[^:]+:[ \t]+//' | sed 's/,//g' to get the actual jail names. The rule name and jail name may not be the same but it should be clear which one is related to which.

Centos – How to change mail “from” name for Fail2Ban email notifications

To elaborate @sebix answer above, you need to modify sendername variable in jail.conf. For example

sendername = Fail2ban.myserver

Or you can replace 'myserver' with hostname -f so you don't need to hardcode the server name in configuration file in each server

sendername = Fail2ban.`hostname -f`

Best Answer

Related Solutions

Iptables – How to Unban an IP properly with Fail2Ban

Centos – How to change mail “from” name for Fail2Ban email notifications

Related Topic