diff --git a/etc/fail2ban/jail.d/20-email.conf b/etc/fail2ban/jail.d/20-email.conf new file mode 100644 index 0000000..546f1c6 --- /dev/null +++ b/etc/fail2ban/jail.d/20-email.conf @@ -0,0 +1,27 @@ +[DEFAULT] + +# -- sorts out sender and destination email addresses + +## -- this will be changed by canonical mapping in postfix +sender = root@albert.server + +## -- destination - will be picked up by /etc/aliases +destemail = root + + +# -- changed it from "sendmail" to "mail". +# -- means it uses mail-whois-lines not sendmail-whois-lines + +mta = mail + +## -- the jail name is set to the name by default +jailname = %(__name__)s + +## use "jailname = Annoying Portscan Sniffer" in a jail to change the name +## .. just for emails, not for chains, etc. + +# ban & send an e-mail with whois report and relevant log lines +# to the destemail, but with a Jail name for forwarding + +action_mwlj = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] + %(mta)s-whois-lines[name=%(jailname)s, sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]