Fail2ban - Ntfy

fail2ban + ntfy (avisos de ban/unban)

Instalar dependencias

sudo apt update
sudo apt install fail2ban curl -y

Crear acción personalizada ntfy

sudo tee /etc/fail2ban/action.d/ntfy.conf >/dev/null <<'EOF'
[Definition]
actionstart = /usr/bin/curl -sS -H "Title: OMV: fail2ban iniciado" -H "Priority: low" \
  -d "fail2ban activo en <name>" "<ntfy_url>"
actionstop  = /usr/bin/curl -sS -H "Title: OMV: fail2ban detenido" -H "Priority: default" \
  -d "fail2ban detenido en <name>" "<ntfy_url>"
actionban   = /usr/bin/curl -sS -H "Title: OMV: IP baneada" -H "Priority: high" \
  -H "Tags: no_entry,warning" \
  -d "Jail=<name>  IP=<ip>  Host=<host>  Time=<time_iso8601>" "<ntfy_url>"
actionunban = /usr/bin/curl -sS -H "Title: OMV: IP desbaneada" -H "Priority: default" \
  -d "Jail=<name>  IP=<ip>  Host=<host>  Time=<time_iso8601>" "<ntfy_url>"

[Init]
# URL de tu servidor ntfy
ntfy_url = https://ntfy.lapecera.es/omv-acceso
EOF

Configurar jail.local

# /etc/fail2ban/jail.local

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5
backend  = systemd
action   = ntfy

[sshd]
enabled  = true
port     = ssh
logpath  = %(sshd_log)s

Reiniciar fail2ban

sudo systemctl restart fail2ban

Probar notificaciones

sudo fail2ban-client set sshd banip 203.0.113.77
sudo fail2ban-client set sshd unbanip 203.0.113.77

Revisar logs

sudo tail -f /var/log/fail2ban.log

Actualizar el canal de ntfy

# Editamos el fichero de configuración de ntfy
sudo -e /etc/fail2ban/action.d/ntfy.conf

# Reiniciamos el servicio de fail2ban
sudo systemctl reload fail2ban