ETOOBUSY 🚀 minimal blogging for the impatient
Fail2ban2geo
TL;DR
Let’s share fail2ban2geo, for fun.
In GeoIP database from MaxMind I was a bit hand-wavy by only giving credits to the tools/data I used without showing any code.
Well, here it is, even with some help!
Installing it can be done with the help of Installing Perl Modules,
thanks to the cpanfile. The help is available by running sub-command
help:
$ ./fail2ban2geo help
map IPs from Fail2ban to Country names
Description:
This program takes the output of:
fail2ban-client status fail2ban
and extracts the list of blocked IPs, then queries them from a local
copy of GeoIP data to see what countries the source IPs were from.
So yes, this can give us an idea of who is trying to brute force
into a server.
Option `--input`/`-i` allows setting the input. By default it's from
STDIN, which is also the case if it set to the string '-'. If the
argument starts with a colon, it's assumed to be the name of a jail
managed by Fail2ban and used to call the command (if the needed jail
is `XXX`):
fail2ban-client status XXX
Option `--fail2ban` allows setting the executable for
`fail2ban-client`, in case it's named differently or not available
in `PATH`. Option `--sudo` allows calling it with `sudo`.
The translation from an IP address to the country name is performed
thanks to the Perl module `IP::Geolocation::MMDB`, which leverages a
DB File in MaxMind format available for free from MaxMind, see:
https://dev.maxmind.com/geoip/geolite2-free-geolocation-data
It's possible to point to the local copy of the database file
through option `--dbpath` or its aliases.
The output is usually sorted from the most frequent down to the
least one. Option `--ascending` and its aliases allow reverting
this.
Options:
ascending: sort in ascending order (most frequent last)
command-line: boolean option
--ascending | --no-ascending
--asc | --no-asc
-a
environment: F2B2G_SORT_ASCENDING
default: 0
dbpath: path to a MaxMind-compatible db file
command-line: mandatory string option
--dbpath <value>
--db <value>
-d <value>
environment: F2B2G_DBPATH
default: /path/to/find2bin2geo/local/city.mmdb
fail2ban: command to run for fail2ban
command-line: mandatory string option
--fail2ban <value>
environment: F2B2G_FAIL2BAN
default: fail2ban-client
input: where to get the input (- => stdin, :XXX => jail XXX)
command-line: mandatory string option
--input <value>
-i <value>
environment: F2B2G_INPUT
default: -
sudo: run with sudo
command-line: boolean option
--sudo | --no-sudo
environment: F2B2G_SUDO
default: 0
Sub-commands:
help: print a help command
commands: list sub-commands
It’s been fun to reinvent this wheel 🙄
Stay safe!