CREATE TABLE `erp_core_fail2ban` (
	`id` BIGINT(20) UNSIGNED NOT NULL AUTO_INCREMENT,
	`hostname` VARCHAR(255) NULL DEFAULT NULL COLLATE 'utf8_unicode_ci',
	`created` TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
	`name` TEXT NOT NULL COLLATE 'utf8_unicode_ci',
	`protocol` VARCHAR(16) NOT NULL COLLATE 'utf8_unicode_ci',
	`port` VARCHAR(32) NOT NULL COLLATE 'utf8_unicode_ci',
	`ip` VARCHAR(64) NOT NULL COLLATE 'utf8_unicode_ci',
	`hostname_attckr` VARCHAR(255) NOT NULL COLLATE 'utf8_unicode_ci',
	`country` VARCHAR(255) NOT NULL COLLATE 'utf8_unicode_ci',
	`org` TEXT NOT NULL COLLATE 'utf8_unicode_ci',
	`asnr` VARCHAR(255) NOT NULL COLLATE 'utf8_unicode_ci',
	PRIMARY KEY (`id`),
	INDEX `hostname` (`hostname`, `ip`)
);

apt-get install fail2ban logrotate jq

################################################## /etcfail2ban/log_sql.sh ###############################################################

#!/bin/bash
#

name=$1
protocol=$2
port=$3
ip=$4;

hname=$(hostname)

VAL=$(curl --silent ipinfo.io/$ip)
json_hostname=$(echo "$VAL" | jq -r ".hostname")
json_country=$(echo "$VAL" | jq -r ".country")
json_org=$(echo "$VAL" | jq -r ".org")
json_as=$(echo $json_org  | head -n1 | cut -d " " -f1)


# WERTE in Datenbank eintragen
INSERT="INSERT INTO erp_core_fail2ban (hostname,name,protocol,port,ip,hostname_attckr,country,org,asnr) VALUES ('${hname}','${name}','${protocol}','${port}','${ip}','${json_hostname}','${json_country}','${json_org}','${json_as}');";
#echo "$INSERT\n";
echo $INSERT | mysql -h 188.68.32.44 -P 3306 -u USERNAME -pPASSWORDHERE -D DHT11
# echo $INSERT

exit 0






################################################## /etc/fail2ban/action.d/mysql-log.conf ###############################################################

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
#

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

# Option:  actioncheck
# Notes.:  command executed once before each actionban command
# Values:  CMD
#
actioncheck =

# Option:  actionban
# Notes.:  command executed when banning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionban = /etc/fail2ban/log_sql.sh <name> <protocol> <port> <ip>

# Option:  actionunban
# Notes.:  command executed when unbanning an IP. Take care that the
#          command is executed with Fail2Ban user rights.
# Tags:    See jail.conf(5) man page
# Values:  CMD
#
actionunban =


################################################## /etc/fail2ban/jail.conf ###############################################################

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define
# action_* variables. Can be overridden globally or per
# section within jail.local file
#banaction = iptables-multiport
banaction = mysql-log

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
#mta = sendmail
mta =