FM / action.d

/etc/fail2ban/action.d

Name	Size	Mode	Actions
abuseipdb.conf	3748	0644	edit dl rm
apf.conf	587	0644	edit dl rm
badips.conf	629	0644	edit dl rm
badips.py	11536	0644	edit dl rm
blocklist_de.conf	2715	0644	edit dl rm
bsd-ipfw.conf	3226	0644	edit dl rm
cloudflare.conf	2970	0644	edit dl rm
complain.conf	4757	0644	edit dl rm
dshield.conf	7668	0644	edit dl rm
dummy.conf	1717	0644	edit dl rm
firewallcmd-allports.conf	1501	0644	edit dl rm
firewallcmd-common.conf	2649	0644	edit dl rm
firewallcmd-ipset.conf	2719	0644	edit dl rm
firewallcmd-multiport.conf	1322	0644	edit dl rm
firewallcmd-new.conf	1950	0644	edit dl rm
firewallcmd-rich-logging.conf	1021	0644	edit dl rm
firewallcmd-rich-rules.conf	1801	0644	edit dl rm
helpers-common.conf	592	0644	edit dl rm
hostsdeny.conf	1657	0644	edit dl rm
ipfilter.conf	1573	0644	edit dl rm
ipfw.conf	1505	0644	edit dl rm
iptables-allports.conf	1514	0644	edit dl rm
iptables-common.conf	2738	0644	edit dl rm
iptables-ipset-proto4.conf	2088	0644	edit dl rm
iptables-ipset-proto6-allports.conf	2742	0644	edit dl rm
iptables-ipset-proto6.conf	2785	0644	edit dl rm
iptables-multiport-log.conf	2170	0644	edit dl rm
iptables-multiport.conf	1508	0644	edit dl rm
iptables-new.conf	1585	0644	edit dl rm
iptables-xt_recent-echo.conf	2672	0644	edit dl rm
iptables.conf	1427	0644	edit dl rm
mail-buffered.conf	2431	0644	edit dl rm
mail-whois-common.conf	1051	0644	edit dl rm
mail-whois-lines.conf	2443	0644	edit dl rm
mail-whois.conf	1842	0644	edit dl rm
mail.conf	1709	0644	edit dl rm
mynetwatchman.conf	5321	0644	edit dl rm
netscaler.conf	1493	0644	edit dl rm
nftables-allports.conf	383	0644	edit dl rm
nftables-multiport.conf	384	0644	edit dl rm
nftables.conf	6318	0644	edit dl rm
nginx-block-map.conf	3746	0644	edit dl rm
npf.conf	1524	0644	edit dl rm
nsupdate.conf	3234	0644	edit dl rm
osx-afctl.conf	497	0644	edit dl rm
osx-ipfw.conf	2302	0644	edit dl rm
pf.conf	3750	0644	edit dl rm
route.conf	1023	0644	edit dl rm
sendmail-buffered.conf	2806	0644	edit dl rm
sendmail-common.conf	1938	0644	edit dl rm
sendmail-geoip-lines.conf	1761	0644	edit dl rm
sendmail-whois-ipjailmatches.conf	1055	0644	edit dl rm
sendmail-whois-ipmatches.conf	1036	0644	edit dl rm
sendmail-whois-lines.conf	1299	0644	edit dl rm
sendmail-whois-matches.conf	1000	0644	edit dl rm
sendmail-whois.conf	950	0644	edit dl rm
sendmail.conf	829	0644	edit dl rm
shorewall-ipset-proto6.conf	3521	0644	edit dl rm
shorewall.conf	2156	0644	edit dl rm
smtp.py	6277	0644	edit dl rm
symbiosis-blacklist-allports.conf	1418	0644	edit dl rm
ufw.conf	1045	0644	edit dl rm
xarf-login-attack.conf	6443	0644	edit dl rm

Edit: /etc/fail2ban/action.d/smtp.py (6277B)

# emacs: -*- mode: python; py-indent-offset: 4; indent-tabs-mode: t -*-
# vi: set ft=python sts=4 ts=4 sw=4 noet :

# This file is part of Fail2Ban.
#
# Fail2Ban is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# Fail2Ban is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Fail2Ban; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

import socket
import smtplib
from email.mime.text import MIMEText
from email.utils import formatdate, formataddr

from fail2ban.server.actions import ActionBase, CallingMap

messages = {}
messages['start'] = \
"""Hi,

The jail %(jailname)s has been started successfully.

Regards,
Fail2Ban"""

messages['stop'] = \
"""Hi,

The jail %(jailname)s has been stopped.

Regards,
Fail2Ban"""

messages['ban'] = {}
messages['ban']['head'] = \
"""Hi,

The IP %(ip)s has just been banned for %(bantime)i seconds
by Fail2Ban after %(failures)i attempts against %(jailname)s.
"""
messages['ban']['tail'] = \
"""
Regards,
Fail2Ban"""
messages['ban']['matches'] = \
"""
Matches for this ban:
%(matches)s
"""
messages['ban']['ipmatches'] = \
"""
Matches for %(ip)s:
%(ipmatches)s
"""
messages['ban']['ipjailmatches'] = \
"""
Matches for %(ip)s for jail %(jailname)s:
%(ipjailmatches)s
"""

class SMTPAction(ActionBase):
	"""Fail2Ban action which sends emails to inform on jail starting,
	stopping and bans.
	"""

def __init__(
		self, jail, name, host="localhost", user=None, password=None,
		sendername="Fail2Ban", sender="fail2ban", dest="root", matches=None):
		"""Initialise action.

Parameters
		----------
		jail : Jail
			The jail which the action belongs to.
		name : str
			Named assigned to the action.
		host : str, optional
			SMTP host, of host:port format. Default host "localhost" and
			port "25"
		user : str, optional
			Username used for authentication with SMTP server.
		password : str, optional
			Password used for authentication with SMTP server.
		sendername : str, optional
			Name to use for from address in email. Default "Fail2Ban".
		sender : str, optional
			Email address to use for from address in email.
			Default "fail2ban".
		dest : str, optional
			Email addresses of intended recipient(s) in comma space ", "
			delimited format. Default "root".
		matches : str, optional
			Type of matches to be included from ban in email. Can be one
			of "matches", "ipmatches" or "ipjailmatches". Default None
			(see man jail.conf.5).
		"""

super(SMTPAction, self).__init__(jail, name)

self.host = host
		#TODO: self.ssl = ssl

self.user = user
		self.password =password

self.fromname = sendername
		self.fromaddr = sender
		self.toaddr = dest

self.matches = matches

self.message_values = CallingMap(
			jailname = self._jail.name,
			hostname = socket.gethostname,
			bantime = lambda: self._jail.actions.getBanTime(),
			)

# bypass ban/unban for restored tickets
		self.norestored = 1

def _sendMessage(self, subject, text):
		"""Sends message based on arguments and instance's properties.

Parameters
		----------
		subject : str
			Subject of the email.
		text : str
			Body of the email.

Raises
		------
		SMTPConnectionError
			Error on connecting to host.
		SMTPAuthenticationError
			Error authenticating with SMTP server.
		SMTPException
			See Python `smtplib` for full list of other possible
			exceptions.
		"""
		msg = MIMEText(text)
		msg['Subject'] = subject
		msg['From'] = formataddr((self.fromname, self.fromaddr))
		msg['To'] = self.toaddr
		msg['Date'] = formatdate()

smtp = smtplib.SMTP()
		try:
			self._logSys.debug("Connected to SMTP '%s', response: %i: %s",
				self.host, *smtp.connect(self.host))
			if self.user and self.password: # pragma: no cover (ATM no tests covering that)
				smtp.login(self.user, self.password)
			failed_recipients = smtp.sendmail(
				self.fromaddr, self.toaddr.split(", "), msg.as_string())
		except smtplib.SMTPConnectError: # pragma: no cover
			self._logSys.error("Error connecting to host '%s'", self.host)
			raise
		except smtplib.SMTPAuthenticationError: # pragma: no cover
			self._logSys.error(
				"Failed to authenticate with host '%s' user '%s'",
				self.host, self.user)
			raise
		except smtplib.SMTPException: # pragma: no cover
			self._logSys.error(
				"Error sending mail to host '%s' from '%s' to '%s'",
				self.host, self.fromaddr, self.toaddr)
			raise
		else:
			if failed_recipients: # pragma: no cover
				self._logSys.warning(
					"Email to '%s' failed to following recipients: %r",
					self.toaddr, failed_recipients)
			self._logSys.debug("Email '%s' successfully sent", subject)
		finally:
			try:
				self._logSys.debug("Disconnected from '%s', response %i: %s",
					self.host, *smtp.quit())
			except smtplib.SMTPServerDisconnected: # pragma: no cover
				pass # Not connected

def start(self):
		"""Sends email to recipients informing that the jail has started.
		"""
		self._sendMessage(
			"[Fail2Ban] %(jailname)s: started on %(hostname)s" %
				self.message_values,
			messages['start'] % self.message_values)

def stop(self):
		"""Sends email to recipients informing that the jail has stopped.
		"""
		self._sendMessage(
			"[Fail2Ban] %(jailname)s: stopped on %(hostname)s" %
				self.message_values,
			messages['stop'] % self.message_values)

def ban(self, aInfo):
		"""Sends email to recipients informing that ban has occurred.

Parameters
		----------
		aInfo : dict
			Dictionary which includes information in relation to
			the ban.
		"""
		if aInfo.get('restored'):
			return
		aInfo.update(self.message_values)
		message = "".join([
			messages['ban']['head'],
			messages['ban'].get(self.matches, ""),
			messages['ban']['tail']
			])
		self._sendMessage(
			"[Fail2Ban] %(jailname)s: banned %(ip)s from %(hostname)s" %
				aInfo,
			message % aInfo)

Action = SMTPAction

cmd: