Skip to content

Instantly share code, notes, and snippets.

@mikeyhill
Forked from Nihisil/jail.local
Created December 22, 2015 05:44
Show Gist options
  • Save mikeyhill/6e50855ea2311b28dc42 to your computer and use it in GitHub Desktop.
Save mikeyhill/6e50855ea2311b28dc42 to your computer and use it in GitHub Desktop.
Send notifications to the Slack from fail2ban
[Definition]
actioncheck=
actionstart =
actionstop =
actionban = /bin/bash /etc/fail2ban/slack_notify.sh "Banned _country_ <ip> in the jail <name> after <failures> attempts" "<ip>" > /dev/null 2>&1
actionunban = /bin/bash /etc/fail2ban/slack_notify.sh "Unbanned _country_ <ip> in the jail <name>" "<ip>" > /dev/null 2>&1
#!/bin/bash
# message first command argument
MESSAGE=$1
HOOK_URL=https://hooks.slack.com/services/<your hook url>
HOST=$(hostname)
CHANNEL="#alerts"
USERNAME="file2ban"
ICON=":cop:"
# ip second command argument
IP=$2
# lets find out from what country we have our hacker
COUNTRY=$(curl ipinfo.io/${IP}/country)
# converting country to lover case. I love you bash script =\
COUNTRY=$( echo "$COUNTRY" | tr -s '[:upper:]' '[:lower:]' )
# slack emoji
COUNTRY=":flag-$COUNTRY:"
# replace _country_ template to the country emoji
MESSAGE="${MESSAGE/_country_/$COUNTRY}"
curl -X POST --data-urlencode "payload={\"channel\": \"${CHANNEL}\", \"username\": \"${USERNAME}\", \"text\": \"[${HOST}] ${MESSAGE}\", \"icon_emoji\": \"${ICON}\"}" ${HOOK_URL}
exit 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment