Fail2ban cannot block SASL abuse

Discussion in 'Installation/Configuration' started by concept21, Jun 23, 2019.

  1. concept21

    concept21 Member

    Hello,
    I am deploying ISPConfig 3.1.13p1 on Ubuntu 18.04.
    I find this confirmed abuse IP on the fail2ban.log but fail2ban does not block it:
    fail2ban.filter [32683]: INFO [postfix-sasl] Found 185.234.219.100

    How do I tune fail2ban to ban it? :oops: Here is the original configuration in my file jail.local:

    [postfix-sasl]
    enabled = true
    filter = postfix[mode=auth]
    port = smtp,465,submission,imap,imaps,pop3,pop3s
    logpath = %(postfix_log)s
    backend = %(postfix_backend)s
     
  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    That file is just the declaration of the jail. For the rules when jail activates, look at file
    Code:
    filter.d/postfix-sasl.conf
    And please use CODE tags when posting listings and logs.
     
    DARK9Y8 likes this.

Share This Page