Fail2ban Plugin

This plugin monitors the number of IP addresses that Fail2ban currently has banned. It reports one value for each jail you choose, so you can see brute-force attacks (for example on SSH, mail or web logins) as they happen and alert on them.

Reported Metrics

For each monitored jail, the plugin reports:

• count: number of IP addresses currently banned in that jail (the "Currently banned" value of fail2ban-client status <jail>).

The value is the current number of bans, not a total since startup. Bans that expire or are removed lower it. If the plugin can't read a jail, for example because it doesn't exist or sudo isn't allowed, count is empty.

Requirements

• Fail2ban is installed and running.
• fail2ban-client is available at /bin/fail2ban-client. On most distributions /bin is a link to /usr/bin, so this works with a normal installation. Check with ls -l /bin/fail2ban-client.
• The names of the jails you want to monitor. List them with:

sudo fail2ban-client status

Allow the agent to run fail2ban-client

The Fail2ban control socket can only be used by root, so the plugin runs fail2ban-client through sudo. The agent can't type a password, so it needs a sudoers rule.

Create /etc/sudoers.d/agent360-fail2ban (mode 0440) with one line for each jail you monitor. For example, for the sshd and postfix jails:

agent360 ALL=(root) NOPASSWD: /bin/fail2ban-client status sshd, /bin/fail2ban-client status postfix

Then check the file:

visudo -cf /etc/sudoers.d/agent360-fail2ban

Don't allow fail2ban-client with any arguments. A rule like agent360 ALL=(ALL) NOPASSWD: /bin/fail2ban-client lets the agent user stop Fail2ban, unban any address, change its configuration and run actions as root, which is full control of the server. Listing the exact status <jail> commands lets the agent only read the ban counts.

Configure the plugin

Add the following lines to the /etc/agent360-custom.ini file:

[fail2ban]
enabled = yes
jail = sshd

To monitor several jails, separate their names with commas and no spaces:

[fail2ban]
enabled = yes
jail = sshd,postfix,dovecot

The plugin doesn't work without the jail option. Each jail you list also needs its own sudoers line, see above.

Test the plugin

Run the following command:

sudo -u agent360 agent360 test fail2ban

The output should show a count for each jail. Then restart the agent for the change to take effect:

service agent360 restart

Troubleshooting

• count is empty for a jail. Run the command as the agent user and check the result:
  Bash

  sudo -u agent360 sudo /bin/fail2ban-client status sshd

  • If it asks for a password or says it's not allowed, fix the sudoers rule. The path and the jail name have to match exactly.
  • If it says the jail doesn't exist, check the name with fail2ban-client status.
  • If it says it can't connect, make sure Fail2ban is running.
• The plugin returns an error. Check that the jail option is set in the [fail2ban] section.
• A jail shows up with a leading space in its name. There was a space after a comma in the jail list. Remove the spaces.
• No data in the dashboard. Make sure the [fail2ban] section is in /etc/agent360-custom.ini, enabled = yes, and that you restarted the agent.