Debian Question posted in
The oficial documentation can be found here.

I can't seem to get Fail2ban to successfully ban IP addresses that are trying to authenticate against our email server – Debian

Recently, my manager installed fail2ban on our ubuntu 10.04 email server to ban ip addresses that failed to authenticate to our email server. As we monitor the system, we don’t see the IPs that continually try to authenticate on our system banned by fail2ban. What are we doing wrong? Below are the conf files:

fail2ban.conf

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 629 $
#

[Definition]

# Option:  loglevel
# Notes.:  Set the log level output.
#          1 = ERROR
#          2 = WARN
#          3 = INFO
#          4 = DEBUG
# Values:  NUM  Default:  3
#
loglevel = 3

# Option:  logtarget
# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
#          Only one log target can be specified.
# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
#
logtarget = /var/log/fail2ban.log

# Option: socket
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
#         not remove this file when Fail2ban runs. It will not be possible to
#         communicate with the server afterwards.
# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
#
socket = /var/run/fail2ban/fail2ban.sock

jail.conf Enabled postfix and sasl filters only

# Fail2Ban configuration file.
#
# This file was composed for Debian systems from the original one
#  provided now under /usr/share/doc/fail2ban/examples/jail.conf
#  for additional examples.
#
# To avoid merges during upgrades DO NOT MODIFY THIS FILE
# and rather provide your changes in /etc/fail2ban/jail.local
#
# Author: Yaroslav O. Halchenko <[email protected]>
#
# $Revision: 281 $
#

# The DEFAULT allows a global definition of the options. They can be override
# in each jail afterwards.

[DEFAULT]

# "ignoreip" can be an IP address, a CIDR mask or a DNS host

# 12/17/19 added to line below: /8
ignoreip = 127.0.0.1/8
bantime  = -1
maxretry = 3

# "backend" specifies the backend used to get files modification. Available
# options are "gamin", "polling" and "auto".
# yoh: For some reason Debian shipped python-gamin didn't work as expected
#      This issue left ToDo, so polling is default backend for now

# 12/17/19 changed from: polling  to: auto
backend = auto

#
# Destination email address used solely for the interpolations in
# jail.{conf,local} configuration files.
destemail = root@localhost

#
# ACTIONS
#

# Default banning action (e.g. iptables, iptables-new,
# iptables-multiport, shorewall, etc) It is used to define 
# action_* variables. Can be overriden globally or per 
# section within jail.local file
banaction = iptables-multiport

# email action. Since 0.8.1 upstream fail2ban uses sendmail
# MTA for the mailing. Change mta configuration parameter to mail
# if you want to revert to conventional 'mail'.
mta = sendmail

# Default protocol
protocol = tcp

#
# Action shortcuts. To be used to define action parameter

# The simplest action to take: ban only
action_ = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report to the destemail.
action_mw = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
              %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s]

# ban & send an e-mail with whois report and relevant log lines
# to the destemail.
action_mwl = %(banaction)s[name=%(__name__)s, port="%(port)s", protocol="%(protocol)s]
               %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s]

# Choose default action.  To change, just override value of 'action' with the
# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local
# globally (section [DEFAULT]) or per specific section 
action = %(action_)s

#
# JAILS
#

# Next jails corresponds to the standard configuration in Fail2ban 0.6 which
# was shipped in Debian. Enable any defined here jail by including
#
# [SECTION_NAME] 
# enabled = true

#
# in /etc/fail2ban/jail.local.
#
# Optionally you may override any other parameter (e.g. banaction,
# action, port, logpath, etc) in that section within jail.local

[ssh]

enabled = false
port    = ssh
filter  = sshd
logpath  = /var/log/auth.log
maxretry = 6

# Generic filter for pam. Has to be used with action which bans all ports
# such as iptables-allports, shorewall
[pam-generic]

enabled = false
# pam-generic filter can be customized to monitor specific subset of 'tty's
filter  = pam-generic
# port actually must be irrelevant but lets leave it all for some possible uses
port = all
banaction = iptables-allports
port     = anyport
logpath  = /var/log/auth.log
maxretry = 6

[xinetd-fail]

enabled   = false
filter    = xinetd-fail
port      = all
banaction = iptables-multiport-log
logpath   = /var/log/daemon.log
maxretry  = 2


[ssh-ddos]

enabled = false
port    = ssh
filter  = sshd-ddos
logpath  = /var/log/auth.log
maxretry = 6

#
# HTTP servers
#

[apache]

enabled = false
port    = http,https
filter  = apache-auth
logpath = /var/log/apache*/*error.log
maxretry = 6

# default action is now multiport, so apache-multiport jail was left
# for compatibility with previous (<0.7.6-2) releases
[apache-multiport]

enabled   = false
port      = http,https
filter    = apache-auth
logpath   = /var/log/apache*/*error.log
maxretry  = 6

[apache-noscript]

enabled = false
port    = http,https
filter  = apache-noscript
logpath = /var/log/apache*/*error.log
maxretry = 6

[apache-overflows]

enabled = false
port    = http,https
filter  = apache-overflows
logpath = /var/log/apache*/*error.log
maxretry = 2

#
# FTP servers
#

[vsftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = vsftpd
logpath  = /var/log/vsftpd.log
# or overwrite it in jails.local to be
# logpath = /var/log/auth.log
# if you want to rely on PAM failed login attempts
# vsftpd's failregex should match both of those formats
maxretry = 6


[proftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = proftpd
logpath  = /var/log/proftpd/proftpd.log
maxretry = 6


[wuftpd]

enabled  = false
port     = ftp,ftp-data,ftps,ftps-data
filter   = wuftpd
logpath  = /var/log/auth.log
maxretry = 6


#
# Mail servers
#

[postfix]
# Enabled line below on 12/17/19 by Jesus
enabled  = true
port     = smtp,ssmtp
filter   = postfix
logpath  = /var/log/mail.log


[couriersmtp]

enabled  = false
port     = smtp,ssmtp
filter   = couriersmtp
logpath  = /var/log/mail.log


#
# Mail servers authenticators: might be used for smtp,ftp,imap servers, so
# all relevant ports get banned
#

[courierauth]

enabled  = false
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = courierlogin
logpath  = /var/log/mail.log


[sasl]
enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
filter   = sasl
# You might consider monitoring /var/log/warn.log instead
# if you are running postfix. See http://bugs.debian.org/507990
logpath  = /var/log/mail.log


# DNS Servers


# These jails block attacks against named (bind9). By default, logging is off
# with bind9 installation. You will need something like this:
#
# logging {
#     channel security_file {
#         file "/var/log/named/security.log" versions 3 size 30m;
#         severity dynamic;
#         print-time yes;
#     };
#     category security {
#         security_file;
#     };
# };
#
# in your named.conf to provide proper logging

# Word of Caution:
# Given filter can lead to DoS attack against your DNS server
# since there is no way to assure that UDP packets come from the
# real source IP
[named-refused-udp]

enabled  = false
port     = domain,953
protocol = udp
filter   = named-refused
logpath  = /var/log/named/security.log

[named-refused-tcp]

enabled  = false
port     = domain,953
protocol = tcp
filter   = named-refused
logpath  = /var/log/named/security.log

postfix.conf

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 728 $
#

[Definition]

# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[w-.^_]+)
# Values:  TEXT
#
failregex = reject: RCPT from (.*)[<HOST>]: 554

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

sasl.conf

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 728 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[w-.^_]+)
# Values: TEXT
#
failregex = (?i): warning: [-._w]+[<HOST>]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

iptables show the following:

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
fail2ban-sasl  tcp  --  anywhere             anywhere            multiport dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
fail2ban-postfix  tcp  --  anywhere             anywhere            multiport dports smtp,ssmtp

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain fail2ban-postfix (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Chain fail2ban-sasl (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

Partial log file entries(/var/log/mail.log)

Dec 29 06:39:16 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:16 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:16 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:16 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:17 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:17 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:17 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:17 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:18 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:18 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:18 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:18 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:18 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:19 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:19 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:19 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:19 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:19 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:19 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:19 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:20 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:20 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:20 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:20 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:21 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:21 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:21 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:21 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:22 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:22 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:22 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:22 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:22 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:23 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:23 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:23 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:23 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:23 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:23 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:24 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:24 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:24 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:24 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:24 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:25 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:25 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:25 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:25 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:26 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:26 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:26 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:26 mail postfix/smtpd[19460]: connect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:26 mail postfix/smtpd[19460]: warning: 38-155-190-109.dsl.ovh.fr[109.190.155.38]: SASL LOGIN authentication failed: authentication failure
Dec 29 06:39:27 mail postfix/smtpd[19460]: lost connection after AUTH from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Dec 29 06:39:27 mail postfix/smtpd[19460]: disconnect from 38-155-190-109.dsl.ovh.fr[109.190.155.38]
Tags:

4

Answers


  1. Chosen as BEST ANSWER
    0

    Changed regex line in the postfix.conf file to the following and it's working great now:

    failregex = (.*)warning: (.*)[<HOST>]: SASL (.*) authentication failed: (.*)

  2. 0

    Jail postfix does not monitoring SASL authentication issues (in v.0.9 at all, in v. >= 0.10 per default).
    There are another default jail postfix-sasl that would do the job.
    If you would upgrade to fail2ban >= 0.10, you can use common jail postfix with specifying mode parameter (to use single jail for any kind of postfix failures), for example:

    [postfix]
mode = aggressive
enabled = true

    For v.0.9 use jail postfix-sasl.
    If your fail2ban version is < 0.9 (but the filter has a common.conf include), you can try to extend the filter you have with this regex:

    _port = (?::d+)?
failregex = ^%(__prefix_line)swarning: [-._w]+[<HOST>]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed

    If doesn’t have common-include (or does not work in your old fail2ban version), the regex could look like:

    failregex = ^s+mails+postfix/S+: warning: [-._w]+[<HOST>](?::d+)?: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed

    You can also use fail2ban-regex to check the filter works for you:

    # >= 0.10:
fail2ban-regex /var/log/mail.log 'postfix[mode=auth]'
fail2ban-regex /var/log/mail.log 'postfix[mode=aggressive]'
# <= 0.9:
fail2ban-regex /var/log/mail.log '/etc/fail2ban/filter.d/postfix-sasl'
# own regex:
fail2ban-regex /var/log/mail.log '^s+mails+postfix/S+: warning: [-._w]+[<HOST>](?::d+)?: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed'
    Login or Signup to reply.
  3. 0

    To make changes safe from being overwritten, place them in jail.d subfolder. Do it something like this:

    cat << EOF | sudo tee /etc/fail2ban/jail.d/postfix-sasl.local
[postfix-sasl]
enabled  = true
EOF

    Also, to enable a protection against really annoying and persistent bots:

    cat << EOF | sudo tee /etc/fail2ban/jail.d/recidive.local
[recidive]
enabled  = true ; enable jail for repeated bans
EOF

    For some unknown reason, the suggested solution from above (https://stackoverflow.com/a/59843252/586898), on version >0.10, didn’t work for me? I’ve created a file in jail.d/postfix-aggressive.local with the following content, but it didn’t work?

    [postfix]
mode = aggressive
    Login or Signup to reply.
  4. 0

    I’ve been trying to fight postfix/SASL abuse for quite some time. The following Fail2Ban settings (blocking incoming through all protocols [tcp/udp] and all ports after repetitive detected postfix/SASL failures) finally worked (as of Fail2Ban v0.10.2):

    /etc/fail2ban/jail.local

    [postfix]
# use "aggressive" to monitor SASL as well
mode = aggressive
enabled = true
findtime = 1d
maxretry = 2
bantime = 2w
# https://github.com/fail2ban/fail2ban/issues/2161
protocol = all
banaction = iptables-allports
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search