fail2ban

If fail2ban already guards your server, this is the easiest integration there is. Every time a jail bans an address, fail2ban also reports it here. Your existing ban action keeps working exactly as before.

Set it up

1. Install the action. One command downloads a ready-made action file pointing at isipsafe:

   curl -s https://isipsafe.com/integrations/fail2ban.conf | sudo tee /etc/fail2ban/action.d/isipsafe.conf

2. Add it to your jails in /etc/fail2ban/jail.local, next to the action you already use. Give each jail the category codes that describe it:

   [sshd]
   enabled = true
   action  = %(action_)s
             isipsafe[categories="ssh,brute-force", key="sl_your_key_here"]
   
   [nginx-botsearch]
   enabled = true
   action  = %(action_)s
             isipsafe[categories="web-app-attack,vuln-scan", key="sl_your_key_here"]
   
   [postfix-sasl]
   enabled = true
   action  = %(action_)s
             isipsafe[categories="mail-server-attack,brute-force", key="sl_your_key_here"]
   
   [recidive]
   enabled = true
   action  = %(action_)s
             isipsafe[categories="hacking", key="sl_your_key_here"]

   The key is required: reporting needs a free account. Your key is on your account page. To avoid repeating it, set key = sl_your_key_here once in the [Init] section of isipsafe.conf.
3. Reload fail2ban:

   sudo fail2ban-client reload

Check it works

Ban a test address by hand, then look it up. Use a documentation-only address so nothing real is reported; the API will politely refuse it, which proves the action ran:

sudo fail2ban-client set sshd banip 203.0.113.9
sudo tail -n 20 /var/log/fail2ban.log

For a real end-to-end test, wait for the next genuine ban and open https://isipsafe.com/ip/THAT_ADDRESS.

Already using another abuse database's action?

Most actions written for other services work after changing the URL to https://isipsafe.com/api/v1/report. The field names are the same, and numeric category IDs 1 to 23 map to the same categories.

Need a hand?

If something here does not work with your version of fail2ban, or you have improved it, tell us. We update these pages with what people send.

fail2ban and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.