# ============================================================
# provider.tools — fail2ban action (Attack Defense Network)
# Reports banned IPs anonymously to reports.provider.tools.
# Free, no account required. Token optional (for your statistics).
#
# Install:
#   sudo curl -o /etc/fail2ban/action.d/provider-tools.conf \
#     "https://reports.provider.tools/api/v1/abuse/fail2ban-config"
#   sudo systemctl restart fail2ban
#
# Use in jail (example sshd):
#   [sshd]
#   enabled = true
#   action = provider-tools[name=ssh, port=ssh]
# ============================================================

[Definition]

actionstart =
actionstop =
actioncheck =
actionban = curl -sS --max-time 10 -X POST "https://reports.provider.tools/api/v1/abuse/report"             -H "Content-Type: application/json"             -H "X-Report-Token: <token>"             -d '{"ip":"<ip>","service":"<name>","port":"<port>","count":1}'

actionunban =

[Init]

# The attack service for this jail (ssh, imap, smtp-auth, http, mysql,
# wordpress, minecraft, ddos, ... - 100+ supported, see the docs)
name = ssh

# Port as reported in the evidence (e.g. ssh, 25, 465, http)
port = 0

# Optional report token from your account (enable per-server statistics).
# Leave EMPTY for anonymous reporting - this is the default and works
# without an account.
token =