py-fail2ban の履歴(No.3)

• 履歴一覧
• 差分 を表示
• 現在との差分 を表示
• ソース を表示
• py-fail2ban へ行く。
  • 1 (2023-09-29 (金) 11:27:31)
  • 2 (2023-09-29 (金) 11:31:10)
  • 3 (2023-09-29 (金) 17:36:15)
  • 4 (2023-09-30 (土) 11:12:41)
  • 5 (2023-09-30 (土) 17:04:49)
  • 6 (2023-10-22 (日) 09:11:45)
  • 7 (2024-01-20 (土) 09:36:19)
  • 8 (2024-02-16 (金) 10:28:39)

CONTENTS

Lastmodified　2024-02-17 (土) 09:25:52

/security/py-fail2ban†

FreeBSD+fail2ban(4)

/etc/rc.conf

fail2ban_enable="YES"

Using Fail2ban with Dovecot

Create the filter file /etc/fail2ban/filter.d/dovecot-pop3imap.conf:†

[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=`<HOST>`

Add the following to /etc/fail2ban/jail.conf:†

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,imap", protocol=tcp]
logpath = /var/log/maillog
maxretry = 20
findtime = 1200
bantime = 1200

fail2banをうまく動かすためのTips。正規表現はシンプルに見やすく

/usr/local/etc/fail2banjail.local

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,imap", protocol=tcp]
#logpath = /var/log/maillog
logpath = /var/log/auth.log
maxretry = 2
findtime = 1200
bantime = 1200
backend = polling
banaction = bsd-ipfw[table=pop3]

# fail2ban-regex /var/log/auth.log /usr/local/etc/fail2ban/filter.d/dovecot-pop3imap.conf --print-all-matched

Running tests
============= 

Use   failregex filter file : dovecot-pop3imap, basedir: /usr/local/etc/fail2ban
Use         log file : /var/log/auth.log
Use         encoding : UTF-8


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [6618] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 6618 lines, 0 ignored, 0 matched, 6618 missed
[processed in 0.53 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 6618 lines

Total access 419：本日 1：昨日 0