Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 30th August 2012, 06:48
snowweb snowweb is offline
Member
 
Join Date: Dec 2010
Posts: 32
Thanks: 4
Thanked 3 Times in 3 Posts
Default Configuring fail2ban for Roundcube

I'm trying to set up fail2ban for Roundcube 0.8.1 which is the latest version.

I've found several instructions for earlier versions of Roundcube like this one, but the log format used back then seems to be a lot different to mine.

This is what I have and what is happening:

in /etc/fail2ban/jail.conf
Code:
[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
action   = iptables-multiport[name=roundcube, port="http,https"]
logpath  = /var/log/roundcubemail/errors
maxretry = 2
ignoreip =
in /etc/fail2ban/filter.d/roundcube.conf
Code:
[Definition]
failregex = IMAP Error: Login failed for .* from <HOST>
ignoreregex =
in /var/log/roundcubemail/errors I see
Code:
[30-Aug-2012 12:18:01 +0800]: IMAP Error: Login failed for john@somedomain.com from 1.2.3.4. AUTHENTICATE PLAIN: Authentication failed. in /var/www/html/shared/roundcubemail-0.8.1/program/include/rcube_imap.php on line 191 (POST /?_task=login&_action=login)
in /var/log/fail2ban.log I get
Code:
2012-08-30 12:18:02,466 fail2ban.filter : WARNING Unable to find a corresponding IP address for 1.2.3.4.
Now I guess the problem is the 'failregex' line of roundcube.conf, but regex isn't something I'm good at. Please can someone tell me what I need on that line?

Many thanks.

Peter
Reply With Quote
Sponsored Links
  #2  
Old 30th August 2012, 09:02
snowweb snowweb is offline
Member
 
Join Date: Dec 2010
Posts: 32
Thanks: 4
Thanked 3 Times in 3 Posts
 
Default

Solved.

This was the regex I used:

Code:
(.*) Login failed for (.*) from <HOST>\.
Reply With Quote
The Following User Says Thank You to snowweb For This Useful Post:
falko (31st August 2012)
Reply

Bookmarks

Tags
fail2ban, regex, roundcube

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Help with Fail2ban florix.net Installation/Configuration 4 26th January 2011 00:53
fail2ban is doing nothing? rlischer Server Operation 16 29th June 2010 07:29
Need help with fail2ban on centos 5.3 rlischer Installation/Configuration 3 14th August 2009 11:47
Xen on Ubuntu kmand HOWTO-Related Questions 17 5th March 2009 18:43
Fail2Ban not banning? tristanlee85 Server Operation 4 15th October 2008 13:44


All times are GMT +2. The time now is 14:41.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.