View Single Post
  #1  
Old 17th March 2010, 16:26
billcouper81 billcouper81 is offline
Junior Member
 
Join Date: Dec 2009
Posts: 29
Thanks: 2
Thanked 4 Times in 3 Posts
Default Have fail2ban monitor Roundcube authentication access errors

I was searching on the net how I could use fail2ban for Roundcube webmail and I found many posts that had bits and pieces of information, but nothing complete... this works with the base installation of roundcube without any plugins

I have this setup with roundcube 0.3.1 and it works fine

Firstly, any IP that has 5 failed connection attempts within 10 minutes will get a 1 hour ban.... repeat offenders (2x 1hr bans within a 6hr period) will be banned for 24 hours...

adjust the roundcube log file path depending on your installation setup


add this to /etc/fail2ban/jail.conf:
Code:
[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
logpath  = /usr/local/roundcube/logs/errors
maxretry = 5
findtime = 600
bantime = 3600

[roundcube-24hr]
enabled = true
port = http,https
filter = roundcube-24hr
logpath = /var/log/fail2ban.log
maxretry = 2
findtime = 21600
bantime = 86400

create new file /etc/fail2ban/filter.d/roundcube.conf
Code:
[Definition]
failregex = IMAP Error: Authentication for .* \(<HOST>\) failed \((?:LOGIN|AUTH)\):
ignoreregex =

create new file /etc/fail2ban/filter.d/roundcube-24hr.conf
Code:
[Definition]
failregex = \[roundcube\] Ban <HOST>
ignoreregex =
you can use the setup style of the 24hr rule above to have cascading bans that increase in length the more repeats are made.. not just for roundcube obviously, but for anything fail2ban is monitoring...
Reply With Quote
Sponsored Links