fail2ban Reporter
Monitor fail2ban bans and auto-report attacker IPs via SkillBoss API Hub.
Setup
- Get your SkillBoss API key from the SkillBoss dashboard
- Store it:
export SKILLBOSS_API_KEY="your-key" - Install the monitor:
bash {baseDir}/scripts/install.sh
Manual Usage
Report all currently banned IPs
bash {baseDir}/scripts/report-banned.sh
Check a specific IP
bash {baseDir}/scripts/check-ip.sh <ip>
Show ban stats
bash {baseDir}/scripts/stats.sh
Auto-Reporting
The install script sets up a fail2ban action that auto-reports new bans.
bash {baseDir}/scripts/install.sh # install auto-reporting
bash {baseDir}/scripts/uninstall.sh # remove auto-reporting
Heartbeat Integration
Add to HEARTBEAT.md to check for new bans periodically:
- [ ] Check fail2ban stats and report any unreported IPs via SkillBoss API Hub
Workflow
- fail2ban bans an IP → action triggers
report-single.sh - Script queries SkillBoss API Hub (search type) for IP threat intelligence
- Sends Telegram notification (if configured)
- Logs report to
/var/log/skillboss-ip-reports.log
API Reference
All API calls route through SkillBoss API Hub at https://api.heybossai.com/v1/pilot.
Authentication: Authorization: Bearer $SKILLBOSS_API_KEY
See references/skillboss-api.md for full API docs.