Fail2ban for Mailservices

[Janko1000]

Hi,

i use Fail2ban for several Services. Now i want to protect our Mailservice eg: pop,pops,imap,imaps etc.
My Fail2ban Rule "courierlogin.conf" looks:

# Fail2Ban configuration file
#
# Author: Christoph Haas
# Modified by: Cyril Jaquier
#
# $Revision: 728 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = LOGIN FAILED, ip=\[<HOST>\]$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

and my jail.conf:

[courierauth]

enabled  = true
port	 = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = courierlogin
logpath  = /opt/psa/var/log/maillog
maxretry = 5
bantime  = 3600

but nothing happend when in /opt/psa/var/log/maillog:

Nov 18 02:41:00 phi74201 courier-imapd: LOGIN FAILED, user=cust@email.de, ip=[::ffff:123.456.789.000]

- Debian 7
- Plesk 11.5


any hints?

 

[IgorG]

JFYI, Fail2Ban will be implemented to Plesk soon - https://plesk.uservoice.com/forums/...ions/3701028-add-fail2ban-as-module-for-plesk

 

[azurro]

1. your failregex is wrong, try this

failregex = LOGIN FAILED,(.*)ip=\[<HOST>\]$

2. you might want to test your filters with

fail2ban-regex /path/to/logfile /etc/fail2ban/filter.d/myfilter.conf

 

[Janko1000]

1. your failregex is wrong, try this

failregex = LOGIN FAILED,(.*)ip=\[<HOST>\]$

2. you might want to test your filters with

fail2ban-regex /path/to/logfile /etc/fail2ban/filter.d/myfilter.conf

Thanks a lot

~# fail2ban-regex /opt/psa/var/log/maillog /etc/fail2ban/filter.d/courierlogin.conf

Success, the total number of match is 133

However, look at the above section 'Running tests' which could contain important
information.

JFYI, Fail2Ban will be implemented to Plesk soon - https://plesk.uservoice.com/forums/...ions/3701028-add-fail2ban-as-module-for-plesk

Thanks for the note, but WHEN it is implemented?

 

[iKovah]

Push for Fail2Ban as a Plesk Package

 

[IgorG]

Thanks for the note, but WHEN it is implemented?

Fail2ban support is implemented already in Plesk 12.0 Preview. More details in Release Notes.