The last time Hackerfall tried to access this page, it returned a not found error. A cached version of the page is below, or clickhereto continue anyway

Cole Turner

If you’re like me, staying on top of server logs is near impossible when you’re administrating more than one website. Even if I had the time, I don’t have the screen real estate to tail all of my server logs.

But I always have time for Slack. It’s on my phone, my computer, and my mind half the day. It makes it easy to communicate when and where you want to.

Using Fail2Ban, we can receive Slack notifications when a jail executes a ban or unban action. When the action is trigger, a notification will be sent to the slack channel of your choice with the corresponding jail name and offending IP.


Slack,  Fail2Ban, CURL

Step 1. 

Generate an Incoming WebHook API Token for Slack:

The first thing you will need is an API token that will allow us to issue commands to the Slack REST API. Using an Incoming Webhook, we can send message to the channel of your choice.

Step 2. 

Create a new ban action for Fail2Ban

With root, use your favorite editor to create the following file:


# # Author: Cole Turner # # # [Definition] # Option: actionstart # Notes.: command executed once at the start of Fail2Ban. # Values: CMD # actionstart = curl -s -o /dev/null '' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'text=Fail2Ban (<name>) jail has started' # Option: actionstop # Notes.: command executed once at the end of Fail2Ban # Values: CMD # actionstop = curl -s -o /dev/null '' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'text=Fail2Ban (<name>) jail has stopped' # Option: actioncheck # Notes.: command executed once before each actionban command # Values: CMD # actioncheck = # Option: actionban # Notes.: command executed when banning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: <ip> IP address # <failures> number of failures # <time> unix timestamp of the ban time # Values: CMD # actionban = curl -s -o /dev/null '' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'text=Fail2Ban (<name>) banned IP *<ip>* for <failures> failure(s)' # Option: actionunban # Notes.: command executed when unbanning an IP. Take care that the # command is executed with Fail2Ban user rights. # Tags: <ip> IP address # <failures> number of failures # <time> unix timestamp of the ban time # Values: CMD # actionunban = curl -s -o /dev/null '' -d 'token=<slack_api_token>' -d 'channel=#<slack_channel>' -d 'text=Fail2Ban (<name>) unbanned IP *<ip>*' [Init] init = 'Sending notification to Slack' slack_api_token = YOUR_SLACK_API_TOKEN_GOES_HERE slack_channel = general

Replace YOUR_SLACK_API_TOKEN_GOES_HERE with the API token you created with the Incoming hook. And where it says “general,” that’s the channel name (without the pound sign).

Save the file. Now it’s time to add this action to one of our jails.

Step 3. 

Apply the action to your jail(s)

For this demonstration we are going to be using the SSH jail. If you haven’t already, create a jail.local file for Fail2Ban in case a package update overwrite the default configuration:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now let’s open /etc/fail2ban/jail.local and add the Slack notification action.

[ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6 banaction = iptables-multiport slack-notify

The “ssh” configuration block will most likely use the default banaction, which means the property won’t be listed. Add the banaction line, using “slack-notify” as the second command. Save and close the file.

Now restart the Fail2Ban service and you should see your jails starting up:

Fail2Ban (ssh) jail has started

If you enjoyed this tip as much as I enjoyed writing it, please like or upvote. Or take it and make it better.

Continue reading on