Blocking can trigger external behaviors such as sending email or other user-defined notifications

[Aldaviva]

As a system administrator, I want to be notified over my preferred communication medium when an IP subnet has been blocked by Fail2Ban4Win, so that I am aware of failed authentication requests to my network and can potentially monitor these blocks with a tool.

[vassilis-panos]

+1

[jdstroy]

Some thoughts on this (though not necessarily suggestions for implementation!):

• One common (and useful) notification would be blocklist.de (another similar service: abuse.ch), which requires knowing which IP address, and log data corroborating the reason for the ban. (Blocklist.de supports email ingestion and HTTPS REST API ingestion.)
• More generally, for a fleet of machines, aggregation of attacker data can be useful (i.e. if 10 IP addresses are in a botnet, that botnet may, for instance, use all 10 IP addresses to probe 5 victim machines; a single system might observe two failed attempts each from 10 addresses each, but 10 failed attempts for each address across all machines in a fleet).
• Pubsub? MQTT?
• Execute an arbitrary command? Plugin? IronPython? PowerShell?

[Aldaviva]

Added plugin strategy to allow admins to supply custom read-only logic when an auth failure or firewall ban occurs. This could be used to send notifications like emails, webhooks, push notifications on Discord/Slack/Telegram/etc, or anything else you want to implement.

• Documentation
• Sample
• Shared interface