Addition/Harden.iRedMail.with.Fail2ban - Revision history

ZhangHuangbin: /* Configure Fail2ban */

ZhangHuangbin — Wed, 05 Sep 2012 01:57:57 GMT

Configure Fail2ban

← Older revision		Revision as of 01:57, 5 September 2012
Line 109:		Line 109:
	# maybe you want to change it to 60 for testing		# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
-	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ~~192.168.1.0/24~~	+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

	[dovecot-iredmail]		[dovecot-iredmail]
Line 121:		Line 121:
	# maybe you want to change it to 60 for testing		# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
-	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ~~192.168.1.0/24~~	+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

	[postfix-iredmail]		[postfix-iredmail]
Line 139:		Line 139:
	bantime = 3600		bantime = 3600
	maxretry = 5		maxretry = 5
-	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 ~~192.168.1.0/24~~	+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
	</pre>}}		</pre>}}

ZhangHuangbin — Wed, 05 Sep 2012 01:20:58 GMT

Configure Fail2ban

← Older revision		Revision as of 01:20, 5 September 2012
Line 109:		Line 109:
	# maybe you want to change it to 60 for testing		# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
		+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 192.168.1.0/24

	[dovecot-iredmail]		[dovecot-iredmail]
Line 120:		Line 121:
	# maybe you want to change it to 60 for testing		# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
-	ignoreip == 127.0.0.1	+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 192.168.1.0/24

	[postfix-iredmail]		[postfix-iredmail]
Line 138:		Line 139:
	bantime = 3600		bantime = 3600
	maxretry = 5		maxretry = 5
-	ignoreip = 127.0.0.1	+	ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 192.168.1.0/24
	</pre>}}		</pre>}}

Mike.f — Mon, 01 Aug 2011 15:59:59 GMT

Configure Fail2ban: add note to ban-time (3600 is one hour)

← Older revision		Revision as of 15:59, 1 August 2011
Line 106:		Line 106:
	findtime = 3600		findtime = 3600
	maxretry = 5		maxretry = 5
		+	# attention: time is in seconds - the value of 3600 means ONE hour
		+	# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600

Line 115:		Line 117:
	maxretry = 5		maxretry = 5
	findtime = 300		findtime = 300
		+	# attention: time is in seconds - the value of 3600 means ONE hour
		+	# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
	ignoreip == 127.0.0.1		ignoreip == 127.0.0.1
Line 130:		Line 134:
	# On FreeBSD, it's "/var/log/maillog".		# On FreeBSD, it's "/var/log/maillog".
	logpath = /var/log/maillog		logpath = /var/log/maillog
		+	# attention: time is in seconds - the value of 3600 means ONE hour
		+	# maybe you want to change it to 60 for testing
	bantime = 3600		bantime = 3600
	maxretry = 5		maxretry = 5

Mike.f — Mon, 01 Aug 2011 15:53:32 GMT

Configure Fail2ban: +info into config (to get sure copy-paste-users find their errors ;)

← Older revision		Revision as of 15:53, 1 August 2011
Line 123:		Line 123:
	action = iptables-multiport[name=postfix, port="ssh,http,https,smtp,smtps,pop3,pop3s,imap,imaps,sieve", protocol=tcp]		action = iptables-multiport[name=postfix, port="ssh,http,https,smtp,smtps,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
	# sendmail[name=Postfix, dest=you@mail.com]		# sendmail[name=Postfix, dest=you@mail.com]
		+
		+	# You may need to change "logpath" of roundcube and postfix filter on different Linux/BSD.
		+	# On RHEL/CentOS, it's "/var/log/maillog".
		+	# On Debian/Ubuntu, it's "/var/log/mail.log".
		+	# On openSUSE, it's "/var/log/mail".
		+	# On FreeBSD, it's "/var/log/maillog".
	logpath = /var/log/maillog		logpath = /var/log/maillog
	bantime = 3600		bantime = 3600

Mike.f — Mon, 01 Aug 2011 15:49:34 GMT

Configure Fail2ban: add path

← Older revision		Revision as of 15:49, 1 August 2011
Line 97:		Line 97:
	** On FreeBSD, it's '''"/var/log/maillog"'''.		** On FreeBSD, it's '''"/var/log/maillog"'''.

		+	* '''/etc/fail2ban/jail.local''' (Linux) or '''/usr/local/etc/fail2ban/jail.local''' (FreeBSD):
	{{cfg\|jail.local\|<pre>		{{cfg\|jail.local\|<pre>
	[roundcube-iredmail]		[roundcube-iredmail]

Mike.f — Mon, 01 Aug 2011 15:46:22 GMT

Configure Fail2ban: name without '

← Older revision		Revision as of 15:46, 1 August 2011
Line 69:		Line 69:
	</pre>}}		</pre>}}

-	* '''/etc/fail2ban/filter.d/dovecot.iredmail.conf''' (Linux) or '''/usr/local/etc/fail2ban/filter.d/dovecot.iredmail.conf'' (FreeBSD):	+	* '''/etc/fail2ban/filter.d/dovecot.iredmail.conf'' (Linux) or '''/usr/local/etc/fail2ban/filter.d/dovecot.iredmail.conf'' (FreeBSD):
	{{cfg\|/etc/fail2ban/filter.d/dovecot.iredmail.conf\|<pre>		{{cfg\|/etc/fail2ban/filter.d/dovecot.iredmail.conf\|<pre>
	[Definition]		[Definition]

ZhangHuangbin — Sun, 12 Jun 2011 15:33:05 GMT

← Older revision		Revision as of 15:33, 12 June 2011
Line 79:		Line 79:
	{{cfg\|/etc/fail2ban/filter.d/postfix.iredmail.conf\|<pre>		{{cfg\|/etc/fail2ban/filter.d/postfix.iredmail.conf\|<pre>
	[Definition]		[Definition]
-	failregex = \[<HOST>\]: SASL PLAIN authentication failed	+	failregex = \[<HOST>\]: SASL (PLAIN\|LOGIN) authentication failed
	reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1		reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
	reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1		reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1

ZhangHuangbin — Thu, 07 Apr 2011 12:44:44 GMT

ZhangHuangbin — Thu, 07 Apr 2011 12:40:32 GMT

Install Fail2ban

← Older revision		Revision as of 12:40, 7 April 2011
Line 12:		Line 12:
	{{cmd\|<pre>		{{cmd\|<pre>
	# yum install fail2ban		# yum install fail2ban
		+	# chkconfig --level 345 fail2ban on
	</pre>}}		</pre>}}

Line 17:		Line 18:
	{{cmd\|<pre>		{{cmd\|<pre>
	# apt-get install fail2ban		# apt-get install fail2ban
		+	# update-rc.d fail2ban defaults
	</pre>}}		</pre>}}

Line 22:		Line 24:
	{{cmd\|<pre>		{{cmd\|<pre>
	# zypper install fail2ban		# zypper install fail2ban
		+	# insserv fail2ban
	</pre>}}		</pre>}}

Line 28:		Line 31:
	# cd /usr/ports/security/py-fail2ban		# cd /usr/ports/security/py-fail2ban
	# make install clean		# make install clean
		+	# echo 'fail2ban_enable="YES"' >> /etc/rc.conf
	</pre>}}		</pre>}}

ZhangHuangbin — Thu, 07 Apr 2011 12:35:29 GMT

Testing

← Older revision		Revision as of 12:35, 7 April 2011
Line 126:		Line 126:

	= Testing =		= Testing =
		+
		+	You can use command '''"fail2ban-regex"''' to verify filter. For example:
		+
		+	{{cmd\|<pre>
		+	# fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/roundcube.iredmail.conf
		+	[…]
		+	Success, the total number of match is 3
		+	[…]
		+	</pre>}}
		+
		+	{{cmd\|<pre>
		+	# fail2ban-regex /var/log/dovecot.log /etc/fail2ban/filter.d/dovecot.iredmail.conf
		+	[…]
		+	Success, the total number of match is 3
		+	[…]
		+	</pre>}}
		+
		+	{{cmd\|<pre>
		+	# fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/postfix.iredmail.conf
		+	[…]
		+	Success, the total number of match is 3
		+	[…]
		+	</pre>}}

	= Troubleshooting =		= Troubleshooting =