Zabbix v7 fail2ban Template

• Zabbix 7.4 fail2ban Template

Zabbix 7.4 fail2ban Template

To monitor Linux host servers fail2ban jails using the zabbix-agent2 official fail2ban template. I start by linking the template to my desired host:

Now I need to create a configuration file for the Zabbix Agent on my host. This one should allow the agent to get a list for all the active jails and retrieve the list of banned IP addresses. The commands are:

~ /usr/bin/fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

    {"data":[{"{#JAIL}":"sshd"}]}

/usr/bin/fail2ban-client status 'sshd' | grep 'Currently banned:' | grep -E -o '[0-9]+'
    1539

Let's add them here:

nano /etc/zabbix/zabbix_agent2.d/plugins.d/fail2ban.conf

Note: Somewhere around zabbix_agent2 version 7.4.x the location changed to the plugins.d sub-directory. Before the include was set to /etc/zabbix/zabbix_agent2.d/. If you upgraded from older versions and kept the agent configuration you will have to change the include in /etc/zabbix/zabbix_agent2.conf accordingly or simply place the fail2ban.conf file one dir higher !

UserParameter=fail2ban.status[*],sudo /usr/bin/fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'
UserParameter=fail2ban.discovery,sudo /usr/bin/fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

By default, executing fail2ban-client requires root privileges. The Zabbix agent user needs passwordless execution rights for these specific commands:

tee /etc/sudoers.d/zabbix-fail2ban >/dev/null <<'EOF'
zabbix ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status
zabbix ALL=(root) NOPASSWD: /usr/bin/fail2ban-client status *
EOF

chmod 440 /etc/sudoers.d/zabbix-fail2ban

systemctl restart zabbix-agent2

sudo -u zabbix zabbix_agent2 -t 'fail2ban.discovery'
sudo -u zabbix zabbix_agent2 -t 'fail2ban.status[sshd]'

fail2ban.discovery                            [s|{"data":[{"{#JAIL}":"sshd"}]}]
fail2ban.banned[sshd]                         [s|1539]