• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Question FAIL2BAN filters. Any filter for this intrusion by internet search scanners?

A

alexk345

Basic Pleskian
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connection established
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: master_notify: status 0
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: name_mask: resource
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: name_mask: software
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connect from scanner-05.ch1.censys-scanner.com[162.142.125.57]
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostname: smtpd_authorized_xforward_hosts: scanner-05.ch1.censys-scanner.com ~? 12>
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostaddr: smtpd_authorized_xforward_hosts: 162.142.125.57 ~? 127.0.0.0/8
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostname: smtpd_authorized_xforward_hosts: scanner-05.ch1.censys-scanner.com ~? [:>
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostaddr: smtpd_authorized_xforward_hosts: 162.142.125.57 ~? [::1]/128
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: smtp_stream_setup: maxtime=3600 enable_deadline=0
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: auto_clnt_open: connected to private/anvil

this is all over my syslog.

i dont see any filters in fail2ban.

How do i write filters?

i wrote a regex to capture all of that ip address

push (@matches,$&) while($search_contents =~ /$regex/gm);

Next is i need to find a way to create filter in fail2ban
 
i am seeing lots of SASL failures in my log files. But postfix-sasl never find any.
So i am testing manually the regex
fail2ban-regex -v /var/log/maillog.processed /etc/fail2ban/filter.d/postfix

This is result i got.
Running tests
=============

Use failregex filter file : postfix, basedir: /etc/fail2ban
Use datepattern : Default Detectors
Use log file : /var/log/maillog.processed
Use encoding : UTF-8


Results
=======

Failregex: 0 total
|- #) [# of hits] regular expression
| 1) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 55[04] 5\.7\.1\s
| 2) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b)
| 3) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b
| 4) [0] ^EHLO from [^[]*\[<HOST>\](?::\d+)?: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b
| 5) [0] ^VRFY from [^[]*\[<HOST>\](?::\d+)?: 550 5\.1\.1\s
| 6) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b
| 7) [0] ^from [^[]*\[<HOST>\](?::\d+)?:?
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [24457] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
| [0] {^LN-BEG}(?:DAY )?MON Day ExYear %k:Minute:Second(?:\.Microseconds)?
| [0] {^LN-BEG}Day(?P<_sep>[-/])Month(?P=_sep)(?:ExYear|ExYear2) %k:Minute:Second
| [0] {^LN-BEG}Day(?P<_sep>[-/])MON(?P=_sep)ExYear[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
| [0] {^LN-BEG}Month/Day/ExYear:24hour:Minute:Second
| [0] {^LN-BEG}Month-Day-ExYear %k:Minute:Second(?:\.Microseconds)?
| [0] {^LN-BEG}Epoch
| [0] {^LN-BEG}ExYear2ExMonthExDay ?24hour:Minute:Second
| [0] {^LN-BEG}MON Day, ExYear 12hour:Minute:Second AMPM
| [0] {^LN-BEG}ExYearExMonthExDay(?:T| ?)Ex24hourExMinuteExSecond(?:[.,]Microseconds)?(?:\s*Zone offset)?
| [0] {^LN-BEG}(?:Zone name )?(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}(?:Zone offset )?(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}TAI64N
| [0] {^LN-BEG}24hour:Minute:Second
| [0] ^<Month/Day/ExYear2@24hour:Minute:Second>
| [0] ^MON-Day-ExYear2 %k:Minute:Second
`-

Lines: 24457 lines, 0 ignored, 0 matched, 24457 missed
[processed in 1.59 sec]

========================================================= END=======================================
Click to expand...


This is sample of maillog.processed


Jan 18 16:06:47 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=15)
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:49 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=9)
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=8)
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=11)
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:52 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=10)
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=8)
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=11)
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:54 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=13)
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Click to expand...
 
You must log in or register to reply here.

Similar threads

P
Issue fail2ban postfix.conf not filtering authentication failures (dictionary attacks)
Replies
0
Views
3K
PeterKi
P
P
Resolved fail2ban postfix-sasl not working correctly
Replies
8
Views
13K
AubsUK
A
WebHostingAce
Question Block MJ12bot with Plesk Fail2Ban plesk-apache-badbot Filter
Replies
7
Views
17K
danami
danami
R
Fail2ban setting findtime per Jail
Replies
13
Views
5K
trialotto
T
Back
Top