mirror of https://github.com/fail2ban/fail2ban
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
105 lines
3.2 KiB
105 lines
3.2 KiB
Description
|
|
-----------
|
|
This plugin checks if the fail2ban server is running and how many IPs are currently banned.
|
|
You can use this plugin to monitor all the jails or just a specific jail.
|
|
|
|
|
|
How to use
|
|
----------
|
|
Just have to run the following command:
|
|
$ ./check_fail2ban --help
|
|
|
|
If you need to use this script with NRPE you just have to do the
|
|
following steps:
|
|
|
|
1 allow your user to run the script with the sudo rights. Just add
|
|
something like that in your /etc/sudoers (use visudo) :
|
|
nagios ALL=(ALL) NOPASSWD: /<path-to>/check_fail2ban
|
|
|
|
2 then just add this kind of line in your NRPE config file :
|
|
command[check_fail2ban]=/usr/bin/sudo /<path-to>/check_fail2ban
|
|
|
|
3 don't forget to restart your NRPE daemon
|
|
|
|
/!\ be careful to let no one able to update the check_fail2ban ;)
|
|
------------------------------------------------------------------------------
|
|
|
|
|
|
Notes (from f2ban.txt)
|
|
-----
|
|
It seems that Fail2ban is currently not working, please login and check
|
|
|
|
HELP:
|
|
|
|
1.) stop the Service
|
|
/etc/init.d/fail2ban stop
|
|
|
|
2.) delete the socket if available
|
|
rm /var/run/fail2ban/fail2ban.sock
|
|
|
|
3.) start the Service
|
|
/etc/init.d/fail2ban start
|
|
|
|
4.) check if fail2ban is working
|
|
fail2ban-client ping
|
|
Answer should be "pong"
|
|
|
|
5.) if the answer is not "pong" run away or CRY FOR HELP ;-)
|
|
|
|
|
|
Help
|
|
----
|
|
|
|
Usage: /<path-to>/check_fail2ban [-p] [-D "CHECK FAIL2BAN ACTIVITY"] [-v] [-c 2] [-w 1] [-s /<path-to>/socket] [-P /usr/bin/fail2ban-client]
|
|
|
|
Options:
|
|
-h, --help
|
|
Print detailed help screen
|
|
-V, --version
|
|
Print version information
|
|
-D, --display=STRING
|
|
To modify the output display
|
|
default is "CHECK FAIL2BAN ACTIVITY"
|
|
-P, --path-fail2ban_client=STRING
|
|
Specify the path to the tw_cli binary
|
|
default value is /usr/bin/fail2ban-client
|
|
-c, --critical=INT
|
|
Specify a critical threshold
|
|
default is 2
|
|
-w, --warning=INT
|
|
Specify a warning threshold
|
|
default is 1
|
|
-s, --socket=STRING
|
|
Specify a socket path
|
|
default is unset
|
|
-p, --perfdata
|
|
If you want to activate the perfdata output
|
|
-v, --verbose
|
|
Show details for command-line debugging (Nagios may truncate the output)
|
|
|
|
|
|
Example
|
|
-------
|
|
|
|
# for a specific jail
|
|
$ ./check_fail2ban --verbose -p -j ssh -w 1 -c 5 -P /usr/bin/fail2ban-client
|
|
DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
|
|
DEBUG : /usr/bin/fail2ban-client exists and is executable
|
|
DEBUG : final fail2ban command: /usr/bin/fail2ban-client
|
|
DEBUG : warning threshold : 1, critical threshold : 5
|
|
DEBUG : it seems the connection with the fail2ban server is ok
|
|
CHECK FAIL2BAN ACTIVITY - OK - 0 current banned IP(s) for the specific jail ssh | currentBannedIP=0
|
|
|
|
# for all the current jails
|
|
$ ./check_fail2ban --verbose -p -w 1 -c 5 -P /usr/bin/fail2ban-client
|
|
DEBUG : fail2ban_client_path: /usr/bin/fail2ban-client
|
|
DEBUG : /usr/bin/fail2ban-client exists and is executable
|
|
DEBUG : final fail2ban command: /usr/bin/fail2ban-client
|
|
DEBUG : warning threshold : 1, critical threshold : 5
|
|
DEBUG : it seems the connection with the fail2ban server is ok
|
|
DEBUG : jails list: apache, ssh-ddos, ssh
|
|
DEBUG : the jail apache has currently 0 banned IPs
|
|
DEBUG : the jail ssh-ddos has currently 0 banned IPs
|
|
DEBUG : the jail ssh has currently 0 banned IPs
|
|
CHECK FAIL2BAN ACTIVITY - OK - 3 detected jails with 0 current banned IP(s) | currentBannedIP=0
|