update

plugins/fail2ban/tpl/fail2ban.d/default.conf

@@ -1,2 +1,25 @@
 [DEFAULT]
-allowipv6 = auto
+allowipv6 = auto
+
+action_ = %(banaction)s[port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+action_mw = %(action_)s
+            %(mta)s-whois[sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
+
+action_mwl = %(action_)s
+             %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
+
+action_xarf = %(action_)s
+             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath="%(logpath)s", port="%(port)s"]
+
+action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"]
+                %(mta)s-whois-lines[sender="%(sender)s", dest="%(destemail)s", logpath="%(logpath)s", chain="%(chain)s"]
+
+action_blocklist_de  = blocklist_de[email="%(sender)s", service="%(__name__)s", apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"]
+
+action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"]
+action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"]
+
+action_abuseipdb = abuseipdb
+
+action = %(action_)s

plugins/fail2ban/tpl/jail.d/sshd.conf

@@ -0,0 +1,11 @@
+#sshd-START
+[sshd]
+enabled = true
+filter = sshd
+port = 2022,no
+maxretry = 5
+findtime = 300
+bantime = 86400
+action = %(action_mwl)s
+logpath = /var/log/auth.log
+#sshd-END