8000 [RFE]: add ip-api.com info to fail2ban.log for jail members · Issue #3790 · fail2ban/fail2ban · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

[RFE]: add ip-api.com info to fail2ban.log for jail members #3790

New issue

Have a question about this project?< 8000 /strong> Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
IgorLytkin opened this issue Jul 9, 2024 · 8 comments
Open

[RFE]: add ip-api.com info to fail2ban.log for jail members #3790

IgorLytkin opened this issue Jul 9, 2024 · 8 comments
Labels
enhancement

Comments

@IgorLytkin
Copy link

Feature request type

Description

Considered alternatives

Any additional information
@sebres
Copy link
Contributor
sebres commented Jul 9, 2024

Geolocation?
Just to link it to #3467 (not about ignore, but geo-info related stuff)...

In between (as long as not implemented) one could try something like that:

{ jail="sshd"; curl http://ip-api.com/batch?fields=country --data "$(fail2ban-client get "$jail" banned | tr "'" '"')"; }

However it'd work only for maximal 100 IPs, otherwise raises an error "HTTP 422 Unprocessable Entity", so one have to buffer them with max 100 IPs per chunk.
Also note another restriction, related to there description (for free access):

Our endpoints are limited to 45 HTTP requests per minute from an IP address. If you go over this limit your requests will be throttled (HTTP 429) until your rate limit window is reset.

So an alternative could be asynchronous service updating the tickets in the database (to avoid repeated bulk queries for already "known" IPs).

@IgorLytkin
Copy link
Author

Yes, it would be a nice solution.

@IgorLytkin
Copy link
Author

So? Let's do it?

@sebres
Copy link
Contributor
sebres commented Jul 28, 2024

Let us define the order of RFEs regarding the precedence questions by ourselves, please.
There are several other open tasks and feature requests with higher or same priority, that I'd like to implement before.

@IgorLytkin
Copy link
Author

Yes, of course.

05bmckay added a commit to 05bmckay/fail2ban that referenced this issue Oct 29, 2024
@05bmckay
Add GeoIP support for banning IPs
c3f3aeb 
Fixes fail2ban#3790

This should be a good fix for issue fail2ban#3790, ip-api is a pretty nice API but I haven't had a ton of time to play with it so I might be missing something. I would greatly appreciate any review on this if someone wanted to help.

---

For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/fail2ban/fail2ban/issues/3790?shareId=XXXX-XXXX-XXXX-XXXX).
@05bmckay 05bmckay mentioned this issue Oct 29, 2024
Closed
@05bmckay
Copy link
05bmckay commented Oct 29, 2024 •
edited
Loading

I would also be pretty interested in this, I was playing with the ip-api today and it seems pretty awesome. @sebres I made a small pull request.

@pano9000
Copy link
Contributor

what about using an "offline" geo-ip database instead of doing an API request to a web server?
Should be a) faster and b) potentially more reliable (because you are not relying on the API being available 24/7)

https://db-ip.com/db/
https://db-ip.com/db/lite.php (this one is CC BY 4.0 licensed)

you would only need to do some monthly database rotation, as they publish new databases on a monthly base

@abdullahdevrel
Copy link

If you are interested, you can take a look at this request: #3687.

From my experience of running fail2ban, geoip alone does not cut it. ASN is also an important metadata. This uses an offline local database and gives both country and ASN information. I am not sure with Fail2ban how important city information is but my experience says that a combination of country and ASN, also known as data centers, could be quite useful. The database is updated daily, comes with full accuracy, and is licensed under CC-BY-SA 4.0 without an EULA.

I work at IPinfo, by the way. We also have a solid free API to offer that provides zip code level accuracy along with ASN.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Add GeoIP support for banning IPs 05bmckay/fail2ban
5 participants
@sebres @05bmckay @IgorLytkin @pano9000 @abdullahdevrel
0