4 ms·

Slack notifications for Fail2Ban

32 points by colept 11y ago

mrmondo 11y ago
Good idea. I'd rather see it use something standard like XMPP and then people can connect it to propriety apps like slack if they so wish.
- stephenr 11y ago
  But that wouldn't get the buzz and attention of the latest techno fanboy circle jerk. I agree completely that these things should use open standards first, and possibly support closed/app specific protocols/Apis second, if said app doesn't support an open standard. But that doesn't work for a lot of devs these days, because it's not an instant popularity contest winner
  - alfanick 11y ago
    couldn't agree more
- mseebach 11y ago
  It's super easy, you just change the URLs to the REST API of your XMPP server?
  - kuschku 11y ago
    Why? XMPP is already a simple protocol, just use that. No need to implement a proprietary REST protocol here.
- colept 11y ago
  Thanks! I know there are better protocols out there to handle this sort of thing, but I'm already using Slack and used this protocol because it fit my own needs and it requires less dependencies to fit those needs.
dhoe 11y ago
On my very insignificant server, fail2ban has banned around 400 IP addresses in 2016, so far. What actionable information would I have received by having a disruptive notification about it?
- sschueller 11y ago
  I agree, what I do instead is track the number of currently banned with nagios and if it goes over a specific threshold I get a warning. With PNP4Nagios you also get a nice graph over time.
- danieltillett 11y ago
  None. It is the attacks that don't get banned that you want to know about. On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?
  - notfoss 11y ago
    For new IP addresses, you can write a script to monitor your auth.log file.
- herbst 11y ago
  I have them in a quiet channel without notifications just to amuse myself. I have not nearly that much tho
xafke 11y ago
I did something similar a while back but used a PHP script to send the notifications to Slack: https://savjee.be/2015/09/Sending-fail2ban-notifications-and-others-to-slack-chat-channel/ https://savjee.be/2015/09/Sending-fail2ban-notifications-and...
delibes 11y ago
Well OK, but I'm not sure I get the point. Surely just feed all logs into Splunk or Logstash or similar? Most monitoring systems have plugins to alert via Slack now.

32 points by colept 11y ago

Good idea. I'd rather see it use something standard like XMPP and then people can connect it to propriety apps like slack if they so wish.

stephenr 11y ago
But that wouldn't get the buzz and attention of the latest techno fanboy circle jerk. I agree completely that these things should use open standards first, and possibly support closed/app specific protocols/Apis second, if said app doesn't support an open standard. But that doesn't work for a lot of devs these days, because it's not an instant popularity contest winner
- alfanick 11y ago
  couldn't agree more
mseebach 11y ago
It's super easy, you just change the URLs to the REST API of your XMPP server?
- kuschku 11y ago
  Why? XMPP is already a simple protocol, just use that. No need to implement a proprietary REST protocol here.
colept 11y ago
Thanks! I know there are better protocols out there to handle this sort of thing, but I'm already using Slack and used this protocol because it fit my own needs and it requires less dependencies to fit those needs.

dhoe 11y ago

On my very insignificant server, fail2ban has banned around 400 IP addresses in 2016, so far. What actionable information would I have received by having a disruptive notification about it?

sschueller 11y ago
I agree, what I do instead is track the number of currently banned with nagios and if it goes over a specific threshold I get a warning. With PNP4Nagios you also get a nice graph over time.
danieltillett 11y ago
None. It is the attacks that don't get banned that you want to know about. On this topic does anyone know if there is something simple that will tell you if a new IP address logs in or a new process is started?
- notfoss 11y ago
  For new IP addresses, you can write a script to monitor your auth.log file.
herbst 11y ago
I have them in a quiet channel without notifications just to amuse myself. I have not nearly that much tho

xafke 11y ago

I did something similar a while back but used a PHP script to send the notifications to Slack: https://savjee.be/2015/09/Sending-fail2ban-notifications-and-others-to-slack-chat-channel/ https://savjee.be/2015/09/Sending-fail2ban-notifications-and...

delibes 11y ago

Well OK, but I'm not sure I get the point. Surely just feed all logs into Splunk or Logstash or similar? Most monitoring systems have plugins to alert via Slack now.