Fail2Ban with abuseIPDB

Support
1

My YunoHost server

Hardware: VPS bought online, Debian 11

YunoHost version: YunoHost 11.2.10.3 (stable)
I have access to my server : SSH & webadmin

Are you in a special context or did you perform some particular tweaking on your YunoHost instance ? : no
If yes, please explain:

Description of my issue

I would like to forward the data to AbuseIPDB in response from Fail2Ban. On my other servers without Yunohost installation I already have them in use. So the syntax is right. I understand that in the Yunohost the Fail2Ban configuration is set with the parameters from /etc/fail2ban/jail.d/yunohost-jails.conf.

So I’ve entered the action here. However, this is still being confirmed. I copied the Jail.conf to jail.local and activated the Abuseip action. I don’t get an error when starting Fail2Ban, what did I forget?

Here the Action in my jail.local für AbuseIP

action_abuseipdb = abuseipdb

hier der Inhalte von

/etc/fail2ban/jail.d/yunohost-jails.conf

[sshd]

port = 22

enabled = true

action = %(action_)s %(action_abuseipdb)s[abuseipdb_apikey=“theapikey”, abuseipd

Thank you very much in advance for your support

2

The problem solved!

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

edit jail.local and paste
action_abuseipdb = abuseipdb

edit the /etc/fail2ban/jail.d/yunohost-jails.conf

paste in the rules:
action = %(action_)s %(action_abuseipdb)s[abuseipdb_apikey=“your-api-key”, abuseipdb_category=“XX,YY”]

XX and YY take a look here: