|
|
| Ligne 136 : |
Ligne 136 : |
|
| |
|
| {{warn | [https://github.com/fail2ban/fail2ban/issues/2378 Apache 404 errors are no longer in Apache 2.4.x error_log]}} | | {{warn | [https://github.com/fail2ban/fail2ban/issues/2378 Apache 404 errors are no longer in Apache 2.4.x error_log]}} |
|
| |
| = Postfix =
| |
| <kode lang='bash'>
| |
| sudo fail2ban-client status postfix-sasl
| |
| # Status for the jail: postfix-sasl
| |
| # |- Filter
| |
| # | |- Currently failed: 0
| |
| # | |- Total failed: 2
| |
| # | `- File list: /var/log/mail.log
| |
| # `- Actions
| |
| # |- Currently banned: 1
| |
| # |- Total banned: 1
| |
| # `- Banned IP list: x.x.x.x
| |
| </kode>
| |
|
| |
| == jails ==
| |
| <filebox fn='/etc/fail2ban/jails.conf' lang='ini'>
| |
| [postfix]
| |
| # To use another modes set filter parameter "mode" in jail.local:
| |
| mode = more
| |
| port = smtp,465,submission
| |
| logpath = %(postfix_log)s
| |
| backend = %(postfix_backend)s
| |
|
| |
| [postfix-rbl]
| |
| filter = postfix[mode=rbl]
| |
| port = smtp,465,submission
| |
| logpath = %(postfix_log)s
| |
| backend = %(postfix_backend)s
| |
| maxretry = 1
| |
|
| |
| [postfix-sasl]
| |
| filter = postfix[mode=auth]
| |
| port = smtp,465,submission,imap,imaps,pop3,pop3s
| |
| # You might consider monitoring /var/log/mail.warn instead if you are
| |
| # running postfix since it would provide the same log lines at the
| |
| # "warn" level but overall at the smaller filesize.
| |
| logpath = %(postfix_log)s
| |
| backend = %(postfix_backend)s
| |
| </filebox>
| |
|
| |
| == filter ==
| |
| <filebox fn='/etc/fail2ban/jails.conf' lang='ini' collapsed>
| |
| # Fail2Ban filter for selected Postfix SMTP rejections
| |
| #
| |
| #
| |
|
| |
| [INCLUDES]
| |
|
| |
| # Read common prefixes. If any customizations available -- read them from
| |
| # common.local
| |
| before = common.conf
| |
|
| |
| [Definition]
| |
|
| |
| _daemon = postfix(-\w+)?/\w+(?:/smtp[ds])?
| |
| _port = (?::\d+)?
| |
|
| |
| prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$
| |
|
| |
| mdpr-normal = (?:NOQUEUE: reject:|improper command pipelining after \S+)
| |
| mdre-normal=^RCPT from [^[]*\[<HOST>\]%(_port)s: 55[04] 5\.7\.1\s
| |
| ^RCPT from [^[]*\[<HOST>\]%(_port)s: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b)
| |
| ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b
| |
| ^EHLO from [^[]*\[<HOST>\]%(_port)s: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b
| |
| ^VRFY from [^[]*\[<HOST>\]%(_port)s: 550 5\.1\.1\s
| |
| ^RCPT from [^[]*\[<HOST>\]%(_port)s: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b
| |
| ^from [^[]*\[<HOST>\]%(_port)s:?
| |
|
| |
| mdpr-auth = warning:
| |
| mdre-auth = ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server| Invalid authentication mechanism)
| |
| mdre-auth2= ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server)
| |
| # todo: check/remove "Invalid authentication mechanism" from ignore list, if gh-1243 will get finished (see gh-1297).
| |
|
| |
| # Mode "rbl" currently included in mode "normal", but if needed for jail "postfix-rbl" only:
| |
| mdpr-rbl = %(mdpr-normal)s
| |
| mdre-rbl = ^RCPT from [^[]*\[<HOST>\]%(_port)s: [45]54 [45]\.7\.1 Service unavailable; Client host \[\S+\] blocked\b
| |
|
| |
| # Mode "rbl" currently included in mode "normal" (within 1st rule)
| |
| mdpr-more = %(mdpr-normal)s
| |
| mdre-more = %(mdre-normal)s
| |
|
| |
| mdpr-ddos = lost connection after(?! DATA) [A-Z]+
| |
| mdre-ddos = ^from [^[]*\[<HOST>\]%(_port)s:?
| |
|
| |
| mdpr-extra = (?:%(mdpr-auth)s|%(mdpr-normal)s)
| |
| mdre-extra = %(mdre-auth)s
| |
| %(mdre-normal)s
| |
|
| |
| mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)
| |
| mdre-aggressive = %(mdre-auth2)s
| |
| %(mdre-normal)s
| |
|
| |
|
| |
|
| |
| failregex = <mdre-<mode>>
| |
|
| |
| # Parameter "mode": more (default combines normal and rbl), auth, normal, rbl, ddos, extra or aggressive (combines all)
| |
| # Usage example (for jail.local):
| |
| # [postfix]
| |
| # mode = aggressive
| |
| # # or another jail (rewrite filter parameters of jail):
| |
| # [postfix-rbl]
| |
| # filter = postfix[mode=rbl]
| |
| #
| |
| mode = more
| |
|
| |
| ignoreregex =
| |
|
| |
| [Init]
| |
|
| |
| journalmatch = _SYSTEMD_UNIT=postfix.service
| |
|
| |
| # Author: Cyril Jaquier
| |
| </filebox>
| |
|
| |
| == variables ==
| |
| <filebox fn='/etc/fail2ban/paths-debian.conf' lang='ini'>
| |
| syslog_mail = /var/log/mail.log
| |
|
| |
| # control the `mail.warn` setting, see `/etc/rsyslog.d/50-default.conf` (if commented `mail.*` wins).
| |
| # syslog_mail_warn = /var/log/mail.warn
| |
| syslog_mail_warn = %(syslog_mail)s
| |
| </filebox>
| |
|
| |
|
| = Installation = | | = Installation = |
