How do I set up fail2ban to send emails using msmtp?
I tried changing the mta = sendmail line to mta = msmtp and the action = %(action_)s line to action = %(action_mwl)s.
I think /etc/fail2ban/action.d/msmtp-whois-lines.conf file, but I'm not sure what to put in it.
I can normally send mail from the command line with echo -e "Subject: subject\nMessage contents" | msmtp [email protected] without a password.
What I would do is the following:
First thing is to copy all action.d/sendmail-*.conf files to action.d/msmtp-*.conf files:
for file in /etc/fail2ban/action.d/sendmail*.conf; do cp "$file" "${file/sendmail/msmtp}"; done
Next step is to change the occurrences of before = sendmail to before = msmtp in the action.d/msmtp-*.conf files:
sed -i 's/before = sendmail/before = msmtp/' /etc/fail2ban/action.d/msmtp-*.conf
This will correct the references to other sendmail configuration files like before = sendmail-common.conf.
Followed by changing all occurrences of sendmail -f <sender> to msmtp in action.d/msmtp-*.conf:
sed -i 's/sendmail -f <sender>/msmtp/p' /etc/fail2ban/action.d/msmtp-*.conf
This will correct the lines where sendmail is called like Fail2Ban | /usr/sbin/sendmail -f <sender> <dest>.
The final step is changing the mta = msmtp in the action.d/jail.conf file.
Then reload fail2ban to test whether these modifications work.
Another thing to keep in mind is the user context of fail2ban with respect to the msmtp configuration. If you have a local msmtprc file configured, it might not be applied when fail2ban tries to run msmtp due to other user context. In that case, configure msmtp with a global configuration, or create a separate configuration for the user that runs fail2ban.
sudo sed -i 's/\/usr\/sbin\/msmtp/\/usr\/bin\/msmtp/' /etc/fail2ban/action.d/msmtp*.conf, and there was also an msmtp.conf file which I changed
As I don't have enough reputation to comment directly under Lambert's extremly helpfull answer, I will add my thought here:
As texasflood pointed out in their comment, you need to run
sudo sed -i 's/\/usr\/sbin\/sendmail/\/usr\/bin\/msmtp/' /etc/fail2ban/action.d/msmtp*.conf
as well [mark the sendmail instead of texasflood's msmtp ! - probably just a typo on their side].
And you might need to add sudo in front of cp or sed in order to get it to work correctly.
