Sign inSign up

swissmakers/fail2ban-ui-agent

By swissmakers

Updated about 2 months ago

A small HTTP service that runs bundled with a Fail2ban in one container. It exposes a JSON REST API.

Image
Security
Integration & delivery
Monitoring & observability
0

1.9K

swissmakers/fail2ban-ui-agent repository overview

fail2ban-ui-agent

Abstract

fail2ban-ui-agent is a small HTTP service that runs bundled with a Fail2ban service in one container. It exposes a JSON REST API secured by a shared secret so Fail2ban-UI can drive the same operations as local or SSH connectors do (jails, filters, ban/unban, reload, logpath checks, and callbacks via a poller).

1. Introduction

Remote control plane for Fail2ban on a single host, consumed by Fail2ban-UI’s Agent-Connector.

The agent does not replace Fail2ban; it requires a working fail2ban daemon and appropriate permissions to manage jails and configuration files. In the following image the agent is already bundled with a fail2ban instance together.

2. Architecture and Fail2ban-UI integration

Overview

  1. Fail2ban-UI connects to the agent using the server URL and agent secret pre-configured per Fail2ban server.
  2. All management traffic uses the v1 API with header X-F2B-Token (see Section 3).
  3. For ban/unban callbacks, Fail2ban-UI pushes the needed settings for verified agents with PUT /v1/callback/config. The agent persists them (under fail2ban-ui-agent.id in the Fail2ban config tree). A poller compares jail state over time and POSTs changes (bans or unbans) to Fail2ban-UI’s /api/ban and /api/unban API secured with the X-Callback-Secret.

IMPORTANT: The poller-based callback path is the only supported model for agent connectors; please do not try to copy ui-custom-action scripts on agent-managed hosts.

3. HTTP API

Base URL is http(s)://<host>:<AGENT_PORT> (default port 9700 unless overridden).

3.1. Authentication
ScopeRequirement
/v1/*Header X-F2B-Token: <AGENT_SECRET> must match the agent’s configured secret (constant-time compare on the server).
/healthz, /readyzNo token required by default

Responses are JSON. Errors typically include an "error" string and appropriate HTTP status codes.

3.2. Public endpoints
MethodPathPurpose
GET/healthzLiveness / health JSON
GET/readyzReadiness when the supervisor reports healthy
3.3. Protected endpoints

All of the following require X-F2B-Token.

Callback configuration

MethodPathPurpose
PUT/v1/callback/configBody: serverId, callbackUrl, callbackSecret, optional callbackHostname -> persisted for the poller

Fail2ban service actions

MethodPathPurpose
POST/v1/actions/reloadReload Fail2ban configuration
POST/v1/actions/restartRestart Fail2ban (with fallbacks where applicable)

Jails

MethodPathPurpose
GET/v1/jailsList jails from fail2ban-client (runtime-oriented)
GET/v1/jails/allBroader jail listing for "Manage jails" UI
GET/v1/jails/{jail}Banned IPs / counts for a jail
POST/v1/jails/{jail}/banBan an IP
POST/v1/jails/{jail}/unbanUnban an IP
GET/v1/jails/{jail}/configRead jail config (with .local / .conf fallback semantics)
PUT/v1/jails/{jail}/configWrite jail config
POST/v1/jailsCreate jail
DELETE/v1/jails/{name}Delete jail
POST/v1/jails/update-enabledMap of jail name -> enabled flag
POST/v1/jails/test-logpathTest log path pattern
POST/v1/jails/test-logpath-with-resolutionResolve %(var)s style log paths then test
GET/v1/jails/check-integrityjail.local presence / managed / legacy UI-action markers
POST/v1/jails/ensure-structureEnsure managed jail.local; optional JSON content

Filters

MethodPathPurpose
GET/v1/filtersList filter names
GET/v1/filters/{name}Read filter config
PUT/v1/filters/{name}Write filter .local
POST/v1/filtersCreate filter
DELETE/v1/filters/{name}Delete filter .local
POST/v1/filters/testRun fail2ban-regex-style test

NOTE: Filter names that contain slashes must be URL-encoded in the path (as implemented in Fail2ban-UI’s connector).

4. Environment variables

VariableDefaultDescription
AGENT_BIND_ADDRESS0.0.0.0Listen address
AGENT_PORT9700Listen port
AGENT_SECRET(empty)Required to start the API server
AGENT_TLS_CERT_FILE / AGENT_TLS_KEY_FILE(empty)Set both to serve HTTPS on AGENT_PORT
AGENT_FAIL2BAN_CONFIG_DIR/etc/fail2banFail2ban configuration root
AGENT_FAIL2BAN_RUN_DIR/var/run/fail2banRuntime directory (socket path context)
AGENT_LOG_ROOT/var/logUsed for logpath tests / resolution
AGENT_HEALTH_INTERVAL30sSupervisor check interval
AGENT_HEALTH_AUTO_RELOADtrueAuto-reload Fail2ban on repeated failures
AGENT_HEALTH_AUTO_RESTARTtrueAuto-restart Fail2ban when reload is not enough
AGENT_HEALTH_MAX_RETRIES3Supervisor retry budget

Callback poller

VariableDefaultDescription
(persisted file)Primary source after PUT /v1/callback/config
AGENT_CALLBACK_URLOptional override (env wins over file when set)
AGENT_CALLBACK_SECRETOptional override
AGENT_CALLBACK_SERVER_IDOptional override
AGENT_CALLBACK_HOSTNAMEOptional override
AGENT_CALLBACK_POLL_INTERVAL4sPoll interval; 0 disables the poller

Persisted callback file path: ${AGENT_FAIL2BAN_CONFIG_DIR}/fail2ban-ui-agent.id.

Tag summary

Content type

Image

Digest

sha256:d657d773a

Size

36.2 MB

Last updated

about 2 months ago

docker pull swissmakers/fail2ban-ui-agent