How to analyze who triggers fail2ban

Howto
20

Unrelated to fail2ban but a quick & dirty script to get the changing IP address of a domain (lets say of another of your publicly reachable hosts) could be something like this:

#!/bin/bash
#
# Update host object IP address (to be used with firewall rules, i.e. for public domain)
# (Requires: dig, ipcalc, e-smith commands)
#

# get IP address
ip=$( /usr/bin/basename $( /usr/bin/dig +short domain.tld A | tr '\n' '/' ) 2>&- )

# validate IPv4 address
if ! /usr/bin/ipcalc -c "$ip"; then exit; fi

# get stored IP address (if any) # hard-coded value
host='hostnamex'
oldip=$( /usr/sbin/e-smith/db hosts getprop $host IpAddress )

# set firewall object to the new IP address
if [ "$ip" = "$oldip" ]
then
   exit
else
   /usr/sbin/e-smith/db hosts set $host host IpAddress $ip
   /usr/sbin/e-smith/signal-event firewall-adjust
fi

For instance to be used with a cron job to update the host ip address used on some firewall rules.
Probably there are better ways to do it but there’s that.

1 Like