Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > ISPConfig 3 > Installation/Configuration

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 21st November 2012, 20:27
blinden blinden is offline
Member
 
Join Date: Sep 2010
Posts: 41
Thanks: 3
Thanked 3 Times in 3 Posts
Default Fail2Ban not banning on dovecot service

New to fail2ban, and just trying to get my settings right

ISPConfig3
Ubuntu 12.04.1 LTS
completely up to date.

Had a long string of these, probably over 1000 of them in alphabetical order from mail.log:

Nov 21 14:01:24 mailserver dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<winston@domain.net>, method=PLAIN, rip=85.13.200.50, lip=10.0.0.22
Nov 21 14:01:41 mailserver dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<wolf@domain.net>, method=PLAIN, rip=85.13.200.50, lip=10.0.0.22
Nov 21 14:01:58 mailserver dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<wolfgang@domain.net>, method=PLAIN, rip=85.13.200.50, lip=10.0.0.22
Nov 21 14:02:15 mailserver dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<woody@domain.net>, method=PLAIN, rip=85.13.200.50, lip=10.0.0.22

from /etc/fail2ban/filter.d/dovecot.conf:

Original, which was commented out
#failregex = .*(?op3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*

Modified:
failregex = (?: pop3-login|imap-login): .*(?isconnected|Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*

from /etc/fail2ban/jail.conf:

[dovecot]

enabled = true
port = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter = dovecot
logpath = /var/log/mail.log
maxretry = 5
findtime = 3600
bantime = 1200

Last edited by blinden; 21st November 2012 at 20:32.
Reply With Quote
Sponsored Links
 

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ISPConfig 3 Single server issues on POP3/IMAP/ MyDNS vk1003 Installation/Configuration 7 17th July 2012 15:25
haproxy with stunnel problem abubin Server Operation 6 10th April 2012 15:08
ISPConfig3 won't start after update Cracklefish Installation/Configuration 15 28th February 2012 14:11
MySQL Error Nolan Installation/Configuration 12 16th February 2011 02:15
Postfix can't received email from exterior astra2000 Server Operation 5 17th October 2009 23:26


All times are GMT +2. The time now is 01:59.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.