Mail warn Log

Discussion in 'Installation/Configuration' started by Robin.k, Nov 3, 2020.

  1. Robin.k

    Robin.k Member

    Hi, i have in "Mail warn Log" a lot of these warnings.
    postfix/smtpd[4296]: warning: unknown[]: SASL LOGIN authentication failed: UGFzc3dvcmQ6

    How to drop these Ip addresses for a week when 3 times try to connect?

  2. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    Configure fail2ban to trigger on those login attempts. Better yet, check if it already has a filter that applies. Recidive jail triggers on repeat offenders and can ban for a week, for example.
  3. Robin.k

    Robin.k Member

    Hi, I found this in the jail.conf
    Is this config active on this way ?
    I don't see if max try is 3 times ban this IP address

    logpath = /var/log/fail2ban.log
    banaction = %(banaction_allports)s
    bantime = 1w
    findtime = 1d
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    I have no idea what OS or what version you are running (since you do not bother mentioning such info), but on my Debian 10 system to activate a fail2ban jail I add to /etc/fail2ban/jail.local
    enabled = true
    and then restart fail2ban with
    systemctl restart fail2ban.service 
  5. Robin.k

    Robin.k Member

    Thanks for the information. I also have Debian 10.

Share This Page