Add Whois information to fail2ban reports

[robb (Rob Bosch)]

When I look at the mails I receive from fail2ban I am intrigued by this part:

Here is more information about [ipaddress] :
missing whois program
Regards,
Fail2Ban

Would it be possible to add the Whois info to the reports? Ultimately a “your are busted ass-hole” email to the offender would be a nice option too…

From the f2b faq:

GitHub - fail2ban/fail2ban: Daemon to ban hosts that cause multiple...

[mark_nl (Mark Verlinde)]

Whois package on NethServer Fail2ban Module

NethServer Version: NethServer release 7.5.1804 (final) Module: NethServer Fail2ban Hi @stephdl, I have installed Fail2ban module from Software center with “whois” package selected to be installed during Fail2ban module installation. However, when I receive email with banned IP, I’m notified that “whois” program is missing. On the other hand, in NS documentation, at Fail2ban section is written: “If you desire to query the IP whois database and obtain the origin of the banned IP by email, …

short recap of linked post

@mark_nl

/usr/bin/whois <ip> || … means the command does not exit 0 which can have multiple causes.

@mark_nl

Out of ideas, its clear the problem is not missing whois, the message “missing whois program” is misleading.

run which whois
or

@stephdl

[root@prometheus ~]# rpm -qa | grep whois

To check if you got bit by misleading feed back.

problem in linked post was:

@GG_jr

OK!

The problem is the port 43 which must be opened on my UTM (outbound traffic from DMZ to WAN). This port is used by IANA for WHOIS services.

Hope it helps

[robb (Rob Bosch)]

Thank you for pointing to @GG_jr’s topic. I totally missed that one. I’ll have it a go…