Ever wished you could get instant notifications in Microsoft Teams when someone tries to break into your server? I've got you covered! I recently created a solution that bridges Fail2Ban security monitoring with Microsoft Teams notifications, complete with geographical information about potential attackers. The Problem 🤔 As a system administrator, monitoring server security events can be challenging. Fail2Ban does an excellent job of detecting and blocking malicious activities, but by default, you only know about these events when you actively check the logs. What if you could get real-time notifications directly in your Teams workspace with detailed information about each security incident? The Solution 💡 I developed fail2ban-ms-teams-notification, a comprehensive integration that sends detailed security alerts to Microsoft Teams channels whenever Fail2Ban detects suspicious activity. fail2ban-ms-teams-notification Key Features ✨ Real-time notifications sent directly to Teams channels
Geographical information about blocked IP addresses
Easy configuration with minimal setup required
Customizable alerts for different services (SSH, Nginx, custom services)
Detailed threat analysis with IP geolocation data Real-time notifications sent directly to Teams channels Real-time notifications Geographical information about blocked IP addresses Geographical information Easy configuration with minimal setup required Easy configuration Customizable alerts for different services (SSH, Nginx, custom services) Customizable alerts Detailed threat analysis with IP geolocation data Detailed threat analysis How It Works 🔧 The integration consists of two main components: teams-geo.conf - A Fail2Ban action configuration file
teams-notify.sh - A notification script that formats and sends alerts to Teams teams-geo.conf - A Fail2Ban action configuration file teams-geo.conf teams-notify.sh - A notification script that formats and sends alerts to Teams teams-notify.sh When Fail2Ban detects suspicious activity, it triggers the Teams notification action, which: Gathers information about the blocked IP address
Fetches geographical data for enhanced threat analysis
Formats a detailed message with all relevant security information
Sends the alert to your configured Teams webhook Gathers information about the blocked IP address Fetches geographical data for enhanced threat analysis Formats a detailed message with all relevant security information Sends the alert to your configured Teams webhook Quick Setup Guide 🚀 Prerequisites Fail2Ban 1.0.2+
Root access to your server
Microsoft Teams workspace with webhook permissions
Network access for HTTPS requests Fail2Ban 1.0.2+ Root access to your server Microsoft Teams workspace with webhook permissions Network access for HTTPS requests Installation Steps Clone the repository
git clone https://github.com/eyeskiller/fail2ban-ms-teams-notification.git cd fail2ban-ms-teams-notification


Install the components
`# Copy action configuration sudo cp teams-geo.conf /etc/fail2ban/action.d/teams-geo.conf
Copy notification script
sudo cp teams-notify.sh /etc/fail2ban/teams-notify.sh sudo chmod +x /etc/fail2ban/teams-notify.sh`


Configure your Teams webhook
`sudo nano /etc/fail2ban/teams-notify.sh
Update the WEBHOOK variable with your Teams webhook URL`


Add to your jail configurations
[sshd] enabled = true port = ssh logpath = %(sshd_log)s maxretry = 3 findtime = 600 bantime = 3600 action = %(action_)s          teams-geo


Restart and test
sudo systemctl restart fail2ban sudo /etc/fail2ban/teams-notify.sh "192.168.1.100" "test-jail" "manual-test" Clone the repository
git clone https://github.com/eyeskiller/fail2ban-ms-teams-notification.git cd fail2ban-ms-teams-notification Clone the repository Clone the repository git clone https://github.com/eyeskiller/fail2ban-ms-teams-notification.git cd fail2ban-ms-teams-notification git clone https://github.com/eyeskiller/fail2ban-ms-teams-notification.git cd fail2ban-ms-teams-notification Install the components
`# Copy action configuration sudo cp teams-geo.conf /etc/fail2ban/action.d/teams-geo.conf
Copy notification script
sudo cp teams-notify.sh /etc/fail2ban/teams-notify.sh sudo chmod +x /etc/fail2ban/teams-notify.sh` Install the components Install the components `# Copy action configuration sudo cp teams-geo.conf /etc/fail2ban/action.d/teams-geo.conf Copy notification script sudo cp teams-notify.sh /etc/fail2ban/teams-notify.sh sudo chmod +x /etc/fail2ban/teams-notify.sh` Configure your Teams webhook
`sudo nano /etc/fail2ban/teams-notify.sh
Update the WEBHOOK variable with your Teams webhook URL` Configure your Teams webhook Configure your Teams webhook `sudo nano /etc/fail2ban/teams-notify.sh Update the WEBHOOK variable with your Teams webhook URL` Add to your jail configurations
[sshd] enabled = true port = ssh logpath = %(sshd_log)s maxretry = 3 findtime = 600 bantime = 3600 action = %(action_)s          teams-geo Add to your jail configurations Add to your jail configurations [sshd] enabled = true port = ssh logpath = %(sshd_log)s maxretry = 3 findtime = 600 bantime = 3600 action = %(action_)s          teams-geo [sshd] enabled = true port = ssh logpath = %(sshd_log)s maxretry = 3 findtime = 600 bantime = 3600 action = %(action_)s          teams-geo Restart and test
sudo systemctl restart fail2ban sudo /etc/fail2ban/teams-notify.sh "192.168.1.100" "test-jail" "manual-test" Restart and test Restart and test sudo systemctl restart fail2ban sudo /etc/fail2ban/teams-notify.sh "192.168.1.100" "test-jail" "manual-test" sudo systemctl restart fail2ban sudo /etc/fail2ban/teams-notify.sh "192.168.1.100" "test-jail" "manual-test" Real-World Usage Examples 🌍 SSH Protection Perfect for monitoring SSH login attempts on your servers. You'll get instant alerts when someone tries to brute-force your SSH service. Web Server Security Integrate with Nginx or Apache logs to monitor HTTP authentication failures and suspicious web activity. Custom Applications Easily extend to any service that logs security events by creating custom Fail2Ban jail configurations. What Makes This Special? 🌟 Unlike basic notification solutions, this integration provides: Geographic context - Know where attacks are coming from
Structured data - Clean, formatted alerts with all relevant information
Production-ready - Includes error handling, testing procedures, and troubleshooting guides
Flexible configuration - Easily customizable for different environments
Comprehensive documentation - Detailed setup and troubleshooting instructions Geographic context - Know where attacks are coming from Geographic context Structured data - Clean, formatted alerts with all relevant information Structured data Production-ready - Includes error handling, testing procedures, and troubleshooting guides Production-ready Flexible configuration - Easily customizable for different environments Flexible configuration Comprehensive documentation - Detailed setup and troubleshooting instructions Comprehensive documentation Troubleshooting Made Easy 🔍 The repository includes comprehensive troubleshooting guides for common issues: Configuration file permission problems
Webhook connectivity issues
Fail2Ban service startup problems
Network connectivity diagnostics Configuration file permission problems Webhook connectivity issues Fail2Ban service startup problems Network connectivity diagnostics Security Considerations 🔒 When implementing this solution, consider: Store webhook URLs securely and rotate them periodically
Be mindful that IP addresses and system information are transmitted
Implement proper firewall rules for outbound webhook traffic
Regularly review and test your notification setup Store webhook URLs securely and rotate them periodically Be mindful that IP addresses and system information are transmitted Implement proper firewall rules for outbound webhook traffic Regularly review and test your notification setup Future Enhancements 🚀 I'm continuously improving this integration. Planned features include: Support for additional messaging platforms
Enhanced threat intelligence integration
Dashboard for historical security events
Advanced alert filtering and categorization Support for additional messaging platforms Enhanced threat intelligence integration Dashboard for historical security events Advanced alert filtering and categorization Get Started Today! Ready to enhance your server security monitoring? Check out the repository on GitHub and start receiving real-time security alerts in your Microsoft Teams workspace. repository on GitHub The setup takes less than 10 minutes, but the peace of mind is invaluable. Your future self will thank you when you catch that next security incident in real-time instead of discovering it days later in log files!

Dash

Apache

Get Real-Time Server Security Alerts in Microsoft Teams with This Fail2Ban Integration

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

The Noonification: Panda Power (11/28/2023)

Windows Sticky Keys Exploit: The War Veteran That Never Dies

06/02/2018: Biggest Stories in the Cryptosphere

0-Days are on the Rise and that Means a Lot More Work for SOC Teams

Time Bombs Inside Software: 0-Day Log4Shell is Just the Tip of The Iceberg

The Noonification: How the Liver Transplant System Changed Forever (11/25/2023)

The Noonification: Panda Power (11/28/2023)

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps