I find csf/lfd much easier to configure and can be used in combination with fail2ban.
Gary Stainburn <gary.stainb...@ringways.co.uk> wrote: >I've followed one of the pages on line specifically for installing fail2ban on >Centos 7 and all looks fine. > >I've added a fail regex to /etc/fail2ban/filter.d/exim.conf as suggested on >another page: > > \[<HOST>\]: 535 Incorrect authentication data > >which appears to be successfully matchnig lines in /var/log/exim/mail.log such >as > >2019-04-19 13:06:10 dovecot_plain authenticator failed for ([185.222.209.71]) >[185.222.209.71]: 535 Incorrect authentication data > >/var/log/fail2ban.log, and the generarted emails all say that the regex is >working and the IP addresses are getting banned. > >2019-04-19 13:06:32,461 fail2ban.filter [21954]: INFO [dovecot] >Found 45.227.253.99 >2019-04-19 13:06:32,607 fail2ban.actions [21954]: NOTICE [dovecot] Ban >45.227.253.99 >2019-04-19 13:06:32,954 fail2ban.filter [21954]: INFO [dovecot] >Found 45.227.253.99 >2019-04-19 13:06:36,664 fail2ban.filter [21954]: INFO [dovecot] >Found 185.222.209.71 >2019-04-19 13:07:16,973 fail2ban.actions [21954]: NOTICE [dovecot] >Unban 185.211.245.198 >2019-04-19 13:07:42,108 fail2ban.actions [21954]: NOTICE [dovecot] >Unban 185.234.217.221 >2019-04-19 13:08:06,475 fail2ban.filter [21954]: INFO [dovecot] >Found 141.98.80.32 >2019-04-19 13:08:11,299 fail2ban.filter [21954]: INFO [dovecot] >Found 185.234.217.162 >2019-04-19 13:08:12,249 fail2ban.actions [21954]: NOTICE [dovecot] Ban >185.234.217.162 >2019-04-19 13:08:16,803 fail2ban.filter [21954]: INFO [dovecot] >Found 141.98.80.32 >2019-04-19 13:08:22,092 fail2ban.filter [21954]: INFO [dovecot] >Found 185.234.217.221 >2019-04-19 13:09:18,178 fail2ban.filter [21954]: INFO [dovecot] >Found 185.211.245.198 >2019-04-19 13:09:30,522 fail2ban.filter [21954]: INFO [dovecot] >Found 185.211.245.198 >2019-04-19 13:09:30,752 fail2ban.actions [21954]: NOTICE [dovecot] Ban >185.211.245.198 >2019-04-19 13:10:48,248 fail2ban.filter [21954]: INFO [dovecot] >Found 185.211.245.198 > > > >However, once an IP address is banned, it continues to appear >in /var/log/exim/main.log which would imply that the ban action is not >working. > >(Also, I don't understand why it's matching against dovecont ewhen the regex >is in exim.conf) > >I've found lots of pages relating to regex errors which this obviously isn't >but I can't seem to find pages about why the ban doesn't work. Does anyone >have any ideas? >_______________________________________________ >CentOS mailing list >CentOS@centos.org >https://lists.centos.org/mailman/listinfo/centos _______________________________________________ CentOS mailing list CentOS@centos.org https://lists.centos.org/mailman/listinfo/centos
