Na}{

File Content: `complain.conf`

# Fail2Ban configuration file
#
# Author: Russell Odom <russ@gloomytrousers.co.uk>, Daniel Black
# Sends a complaint e-mail to addresses listed in the whois record for an
# offending IP address.
# This uses the https://abusix.com/contactdb.html to lookup abuse contacts.
#
# DEPENDENCIES:
# This requires the dig command from bind-utils
#
# You should provide the <logpath> in the jail config - lines from the log
# matching the given IP address will be provided in the complaint as evidence.
#
# WARNING
# -------
#
# Please do not use this action unless you are certain that fail2ban
# does not result in "false positives" for your deployment.  False
# positive reports could serve a mis-favor to the original cause by
# flooding corresponding contact addresses, and complicating the work
# of administration personnel responsible for handling (verified) legit
# complains.
#
# Please consider using e.g. sendmail-whois-lines.conf action which
# would send the reports with relevant information to you, so the
# report could be first reviewed and then forwarded to a corresponding
# contact if legit.
#


[INCLUDES]

before = helpers-common.conf

[Definition]

# Used in test cases for coverage internal transformations
debug = 0

# bypass ban/unban for restored tickets
norestored = 1

# Option:  actionstart
# Notes.:  command executed on demand at the first ban (or at the start of Fail2Ban if actionstart_on_demand is set to false).
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed at the stop of jail (or at the end of Fail2Ban)
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = oifs=${IFS};
            RESOLVER_ADDR="%(addr_resolver)s"
            if [ "<debug>" -gt 0 ]; then echo "try to resolve $RESOLVER_ADDR"; fi
            ADDRESSES=$(dig +short -t txt -q $RESOLVER_ADDR | tr -d '"')
            IFS=,; ADDRESSES=$(echo $ADDRESSES)
            IFS=${oifs}
            IP=<ip>
            if [ ! -z "$ADDRESSES" ]; then
                ( printf %%b "<message>\n"; date '+Note: Local timezone is %%z (%%Z)'; 
                  printf %%b "\nLines containing failures of <ip> (max <grepmax>)\n";
                  %(_grep_logs)s;
                ) | <mailcmd> "Abuse from <ip>" <mailargs> $ADDRESSES
            fi

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban =

# Server as resolver used in dig command
#
addr_resolver = <ip-rev>abuse-contacts.abusix.org

# Default message used for abuse content
#
message = Dear Sir/Madam,\n\nWe have detected abuse from the IP address $IP, which according to a abusix.com is on your network. We would appreciate if you would investigate and take action as appropriate.\n\nLog lines are given below, but please ask if you require any further information.\n\n(If you are not the correct person to contact about this please accept our apologies - your e-mail address was extracted from the whois record by an automated process.)\n\n This mail was generated by Fail2Ban.\nThe recipient address of this report was provided by the Abuse Contact DB by abusix.com. abusix.com does not maintain the content of the database. All information which we pass out, derives from the RIR databases and is processed for ease of use. If you want to change or report non working abuse contacts please contact the appropriate RIR. If you have any further question, contact abusix.com directly via email (info@abusix.com). Information about the Abuse Contact Database can be found here: https://abusix.com/global-reporting/abuse-contact-db\nabusix.com is neither responsible nor liable for the content or accuracy of this message.\n

# Path to the log files which contain relevant lines for the abuser IP
#
logpath = /dev/null

# Option:  mailcmd
# Notes.:  Your system mail command. Is passed 2 args: subject and recipient
# Values:  CMD
#
mailcmd = mail -E 'set escape' -s

# Option:  mailargs
# Notes.:  Additional arguments to mail command. e.g. for standard Unix mail:
#          CC reports to another address:
#              -c me@example.com
#          Appear to come from a different address - the '--' indicates
#          arguments to be passed to Sendmail:
#              -- -f me@example.com
# Values:  [ STRING ]
#
mailargs =

# Number of log lines to include in the email
#
#grepmax = 1000
#grepopts = -m <grepmax>

Name	Size	Permission
abuseipdb.conf	3748 bytes	0644
apf.conf	587 bytes	0644
apprise.conf	1413 bytes	0644
blocklist_de.conf	2715 bytes	0644
bsd-ipfw.conf	3226 bytes	0644
cloudflare-token.conf	3072 bytes	0644
cloudflare.conf	3037 bytes	0644
complain.conf	4773 bytes	0644
dshield.conf	7684 bytes	0644
dummy.conf	1717 bytes	0644
firewallcmd-allports.conf	1501 bytes	0644
firewallcmd-common.conf	2649 bytes	0644
firewallcmd-ipset.conf	3928 bytes	0644
firewallcmd-multiport.conf	1270 bytes	0644
firewallcmd-new.conf	1898 bytes	0644
firewallcmd-rich-logging.conf	1021 bytes	0644
firewallcmd-rich-rules.conf	1753 bytes	0644
helpers-common.conf	592 bytes	0644
hostsdeny.conf	1657 bytes	0644
ipfilter.conf	1573 bytes	0644
ipfw.conf	1505 bytes	0644
iptables-allports.conf	291 bytes	0644
iptables-ipset-proto4.conf	2221 bytes	0644
iptables-ipset-proto6-allports.conf	814 bytes	0644
iptables-ipset-proto6.conf	773 bytes	0644
iptables-ipset.conf	2810 bytes	0644
iptables-multiport-log.conf	2163 bytes	0644
iptables-multiport.conf	232 bytes	0644
iptables-new.conf	332 bytes	0644
iptables-xt_recent-echo.conf	2842 bytes	0644
iptables.conf	4791 bytes	0644
ipthreat.conf	4291 bytes	0644
mail-buffered.conf	2495 bytes	0644
mail-whois-common.conf	1051 bytes	0644
mail-whois-lines.conf	2459 bytes	0644
mail-whois.conf	1890 bytes	0644
mail.conf	1757 bytes	0644
mikrotik.conf	2546 bytes	0644
mynetwatchman.conf	5321 bytes	0644
netscaler.conf	1493 bytes	0644
nftables-allports.conf	383 bytes	0644
nftables-multiport.conf	384 bytes	0644
nftables.conf	6317 bytes	0644
nginx-block-map.conf	4010 bytes	0644
npf.conf	1524 bytes	0644
nsupdate.conf	3234 bytes	0644
osx-afctl.conf	497 bytes	0644
osx-ipfw.conf	2302 bytes	0644
pf.conf	4082 bytes	0644
route.conf	1023 bytes	0644
sendmail-buffered.conf	2806 bytes	0644
sendmail-common.conf	1939 bytes	0644
sendmail-geoip-lines.conf	1761 bytes	0644
sendmail-whois-ipjailmatches.conf	1055 bytes	0644
sendmail-whois-ipmatches.conf	1036 bytes	0644
sendmail-whois-lines.conf	1299 bytes	0644
sendmail-whois-matches.conf	1000 bytes	0644
sendmail-whois.conf	950 bytes	0644
sendmail.conf	829 bytes	0644
shorewall-ipset-proto6.conf	3762 bytes	0644
shorewall.conf	2156 bytes	0644
smtp.py	6655 bytes	0644
symbiosis-blacklist-allports.conf	1503 bytes	0644
ufw.conf	2379 bytes	0644
xarf-login-attack.conf	6443 bytes	0644

File Content: complain.conf

File Content: `complain.conf`