Fail2ban - whois lookup

[schulzstefan (Stefan M. Schulz)]

Good evening to the devs,

I’d like to question how about a whois lookup for banned IP’s. IMVHO fail2ban is an essential piece of security. Therefore any information of a banned IP would be helpful in case of an unban.

regards,
stefan

[Andy_Wismer (André Wismer)]

Hi

Easy enough - Just install whois:

yum install -y whois

The whois info will be included…

My 2 cents
Andy

[schulzstefan (Stefan M. Schulz)]

Hi Andi,

the FR was meant in the application fail2ban. There is an entry to unban a banned IP. Before unbanning it would be nice to have the link from the banned IP to whois. Which right now is not possible (at least for me). Do I miss something?

[Andy_Wismer (André Wismer)]

Hi

As far as I recall, the info is included in the mail report.

My 2 cents
Andy

[schulzstefan (Stefan M. Schulz)]

Didn’t try the mail report yet. I’ll enable it and report.

regards,
stefan

[robb (Rob Bosch)]

@Andy_Wismer is correct here. In the mailreport about blocked IP addresses the whois info is added only if you have installed whois.
Maybe this should be added to fail2ban package? I know, it’s just 1 line to install it manually, but it would be nice if whois gets installed when fail2ban is installed. @stephdl

/edit: we have some history on this topic:

Whois package on NethServer Fail2ban Module

NethServer Version: NethServer release 7.5.1804 (final) Module: NethServer Fail2ban Hi @stephdl, I have installed Fail2ban module from Software center with “whois” package selected to be installed during Fail2ban module installation. However, when I receive email with banned IP, I’m notified that “whois” program is missing. On the other hand, in NS documentation, at Fail2ban section is written: “If you desire to query the IP whois database and obtain the origin of the banned IP by email, …

Add Whois information to fail2ban reports

When I look at the mails I receive from fail2ban I am intrigued by this part: Here is more information about [ipaddress] : missing whois program Regards, Fail2Ban Would it be possible to add the Whois info to the reports? Ultimately a “your are busted ass-hole” email to the offender would be a nice option too… From the f2b faq: https://www.fail2ban.org/wiki/index.php/FAQ_english#I_get_emails_containing_.22Here_are.2Fis_more_information_about_.3Cip.3E.22_and_then_nothing

What are the steps to install whois information for fail2ban

NethServer Version: 7.9.2009 Module: Fail2ban - Hello @support_team, I’ve installed fail2ban on my Nethserver and I’m very happy to have it. But I’ve noticed that when an IP is banned I receive an email like the following: Hi, The IP 45.72.235.197 has just been banned by Fail2Ban after 6 attempts against nextcloud-auth. Here is more information about 45.72.235.197 : missing whois program Regards, Fail2Ban I’ve searched the forums and found reference to whois being an available opti…

[schulzstefan (Stefan M. Schulz)]

Yes, it is.

Thank’s for the hint.

regards,
stefan

[Andy_Wismer (André Wismer)]

Hi @schulzstefan

If possible, please mark this as solved, it might help others with the same problem…

Howto mark a topic as solved

Now we have an amazing feature on our community platform which helps to mark a topic as SOLVED As the OP (topic creator) you will have a button that allows you to accept an answer [image] Accepted answers are highlighted in the topic list: [image] Accepted answers are highlighted on the initial topic: [image] This kind of action is enabled only for topic into the Support category Happy support!

Thx

Andy