When Fail2ban detects and blocks and intrusion, it sends an email letting me know what IP address has been blocked. Since I have multiple FreePBX deployments, it becomes difficult trying to figure out which FreePBX the email is coming from.
Is there a way to customize the Fail2ban email that is sent so that there will be some identifying text in the email?
If your hostname is unique then you could identify the different FreePBX deployments in both subject and body of the emails. Not sure which one of the files below responsible about sending the mail but all has the same email text.
/etc/fail2ban/action.d/mail-whois-lines.conf
/etc/fail2ban/action.d/mail-whois.conf
/etc/fail2ban/action.d/mail.conf
/etc/fail2ban/action.d/sendmail-whois-lines.conf
/etc/fail2ban/action.d/sendmail-whois.conf
/etc/fail2ban/action.d/sendmail-whois.local
/etc/fail2ban/action.d/sendmail.conf
/etc/fail2ban/action.d/sendmail.local
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.