Zabbix fail2ban monitoring with LLD

[limo]

Hi to all,

my collegue just made script and template for fail2ban jails.
It automaticaly discovers jails and return basic informations about it.
Feel free to use/discuss!

Here is README:

Zabbix fail2ban lld
2014 dron, [email protected]

copy fail2ban_jail_discovery and fail2ban_jail_banned to /etc/zabbix/scripts.
Be sure that zabbix-agent can run these scripts.

add this to UserParameter section of zabbix-agentd.conf 

UserParameter=fail2ban.jail.banned[*],/etc/zabbix/scripts/fail2ban_jail_banned $1
UserParameter=fail2ban.jail.discovery,/etc/zabbix/scripts/fail2ban_jail_discovery

import zbx_fail2ban_lld_template.xml template

TODO:

Fail2ban create socket (/var/run/fail2ban/fail2ban.sock) with 700 perms. 
zabbix-agent needs read permission to read jails from fail2ban-client
so my workaround is to modify init.d script (add chown zabbix:root ${socket})

start() {
    echo -n $"Starting fail2ban: "
    ${FAIL2BAN} -x start > /dev/null
    RETVAL=$?
    if [ $RETVAL = 0 ]; then
        chown zabbix:root ${socket}
        touch ${lockfile}
        echo_success
    else
        echo_failure
    fi
    echo
    return $RETVAL
}

[asaveljevs]

Similar user parameter solution with one-liners:

UserParameter=fail2ban.status[*],fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'
UserParameter=fail2ban.discovery,fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\w\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

[BDiE8VNy]

Similar user parameter solution with one-liners:

UserParameter=fail2ban.status[*],fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'
UserParameter=fail2ban.discovery,fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\w\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

How about adding these to http://zabbix.org/wiki/User_parameter_one-liners

[romale]

Similar user parameter solution with one-liners:

UserParameter=fail2ban.status[*],fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'
UserParameter=fail2ban.discovery,fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\w\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

if i've this jails "dovecot-auth, sendmail", so result of script "fail2ban.discovery" is:
{"data":[{"{#JAIL}":"dovecot"}-{"{#JAIL}":"auth"}, {"{#JAIL}":"sendmail"}]}

How to bring to?
{"{#JAIL}":"dovecot-auth"},{"{#JAIL}":" sendmail"}

Thanks

[romale]

limo, thank you, works good.

plus, i've added:
1. scripts execution via sudo
2. fail2ban server checking and trigger for this
3. sudo file fo zabbix
4. graph prototype


1,2. zabbix userparameters:
### Fail2ban monitoring
UserParameter=fail2ban.status,res=$(sudo fail2ban-client ping|awk '{print $3}');if [ "$res" == "pong" ]; then echo 1; else echo 0;fi
UserParameter=fail2ban.jail.banned[*],sudo /opt/scripts/fail2ban_jail_banned $1
UserParameter=fail2ban.jail.discovery,sudo /opt/scripts/fail2ban_jail_discovery
### end

3.
cat /etc/sudoers.d/zabbix
## sudoers file.
zabbix ALL=(ALL) NOPASSWD: /usr/bin/fail2ban-client ping, /opt/scripts/fail2ban_jail_discovery, /opt/scripts/fail2ban_jail_banned *

modified template in attachment

[limo]

Please try zaf version.

curl -k https://raw.githubusercontent.com/limosek/zaf/master/install.sh | sh
zaf install fail2ban

See https://github.com/limosek/zaf for more info.

[michaelwemoto]

Similar user parameter solution with one-liners:

UserParameter=fail2ban.status[*],fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'
UserParameter=fail2ban.discovery,fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\w\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

I'm seeing the same issue as Romale, my jails have hyphens and it's not splitting correctly.

Could you tweak this expression to stop it stripping the -'s?

Other than that, great solution, much preferred to not have remote scripts.

[asaveljevs]

A quick fix would be to simply add "-" character to the second sed expressoin:

... -e 's/\(\(\w|-\)\+\)/{"{#JAIL}":"\1"}/g' ...

[michaelwemoto]

A quick fix would be to simply add "-" character to the second sed expressoin:

... -e 's/\(\(\w|-\)\+\)/{"{#JAIL}":"\1"}/g' ...

Close....

fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

produces;
{"data":[postfix-rcpt, postfix-smtp, ssh-iptables]}

Not to worry, monitoring the number of banned IP's isn't massively important to me.

thanks!

[asaveljevs]

Yes, sorry, there should have been a backslash before the pipe:

... -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' ...

[michaelwemoto]

Yes, sorry, there should have been a backslash before the pipe:

... -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' ...

Thank you kindly sir

[Yannick038]

Please try zaf version.

See https://github.com/limosek/zaf for more info.

Tried to setup ZAB 1.3 with zabbix 3.2 but this seems not to be working

i have installed zaf
added zaf failban plugin and imported zaf plugin template in my host

but if i am doing a quick test

zaf test fail2ban.jail_discovery i only get :
fail2ban.jail_discovery [t|{ "data":[ { "{#F2BJAIL}":"sshddos," } ] }]

of course i have multiple F2B jails running so it is only reporting one of them (not the first one)

any help appreciated !

[Colttt]

hello,

when I am running

/usr/bin/fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

i got

{"data":[{"{#JAIL}":"ssh"}]}

but zabbix said

Value should be a JSON object.

but it looks fine.. any idea?

[Yannick038]

Please check that you're using the same user as zabbix

ie if you're using root to run your command it will work whereas it will not work when run under zabbix user (try to sudo zabbix first after having enable ssh login for zabbix user)

I personnally passed to use lld using sudo fail2ban-client commands (and having enabled zabbix users in sudoers list)