I have got fail2ban up and running, but....

MGAV · Mar 26th 2014

I got fail2ban running according to the settings in the wiki. And everything seems to be working after a few tweaks.

But today I encountered a lot of entries in the "mail.warn" log file (see below - changed the IP by xxx). How do I effectively close for this?

Mar 26 20:06:59 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:06:59 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:06:59 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:06:59 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:00 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:00 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:00 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:00 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:01 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:01 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:01 host1 postfix/smtpd[5723]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:01 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:01 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:02 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:02 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:02 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:02 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:02 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:03 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:03 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:03 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:03 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:03 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:04 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:04 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:04 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure
Mar 26 20:07:04 host1 postfix/smtpd[5724]: warning: unknown[xxx.xxx.xxx.xxx]: SASL LOGIN authentication failed: authentication failure

It seem to take up a lot of resources (CPU) and (Disk I/O utilization), so it would be nice to get this banned.

Michael

**Nuxwin** · Mar 26th 2014

Hello ;

Show us your fail2ban configuration, specially the configuration file where you added your filters.

MGAV · Mar 26th 2014

It is almost exactly as the wiki...

http://wiki.i-mscp.net/doku.php?id=start:howto:fail2ban

The only thing that I tweaked is the following entries:

ignoreip = 127.0.0.1/8 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx
findtime = 1800
bantime = 1800
maxretry = 6

The rest is the same!

**ciscllc** · Mar 28th 2014

Hi.

I cannot see any postfix things in the howto. You may need a filter for postfix. I am on my phone right now so I cannot have a look at the applied filters but do a google search for fail2ban postfix. I can send you my config and filter tomorrow if needed.

Regards

**ciscllc** · Mar 28th 2014

There should be some kind of sasl filter too.

MGAV · Mar 29th 2014

That is the point. When I look in to the filters, I see them all. But I have to take a closer look to see if one is looking at mail.warn.

Would appreciate to have a look at yours!

**victor531** · Mar 29th 2014

Hi MGAV, you need to add in jail.conf

Code

[sasl]enabled = trueport = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3sfilter = saslmaxretry = 2bantime = 36000

and /etc/fail2ban/filter.d/sasl.conf must contain

Code

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 728 $
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL LOGIN authentication failed
(?i): warning: [-._\w]+\[<HOST>\]: SASL CRAM-MD5 authentication failed
(?i): warning: [-._\w]+\[<HOST>\]: SASL PLAIN authentication failed
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =

Display More

After that you need to restar the service

/etc/init.d/fail2ban restart

Done

Suerte

Victor

MGAV · Mar 29th 2014

Done, thanks...

No I will see what happens...

**victor531** · Mar 29th 2014

Hi MGAV , to check this rule, run in your server this

Code

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/sasl.conf

and tell me what happend

Victor

MGAV · Apr 1st 2014

It seem to work perfectly.

Thank you very much!

I have got fail2ban up and running, but....

Share

Daily visitors