Fail2ban can be downloaded from YUM You need to change some settings in the config files to match your requirements. Its also has settings for bantime, who to mail when someone gets banned (ip adress), it uses iptables to update blocking schemes.
I use fail2ban for pop3, smtp, ftp B/R Ole Using two latest Centos dists with QMT and Fail2Ban enabled. > Thanks, > But what if they are from different IP or I don't even get aware of the > attack? > > I think the best approach would be to use fail2ban. So I need someone that > already has a rule > > Thanks > > On 29 July 2011 16:16, Sergio Rosa <[email protected]> wrote: > >> block them at the fw level. or place an iptables rules on your host. >> This >> will do the job if the source ip is the same all the time. >> >> --- >> Thank you, >> Sérgio Rosa >> >> T. +351 91348 9195 >> @. [email protected] >> >> AWD - Arq. Web e Design, Unip. Lda >> R. Moinho Velho, 19, 2ºDto >> 2655-242 Ericeira >> http://www.awd.pt >> >> >> On Fri, 29 Jul 2011 16:10:08 +0200, Délsio Cabá wrote: >> >>> Hi, >>> >>> I see these logs on pop3: >>> @400000004e32be9f2581381c tcpserver: ok 19434 >>> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::3912 >>> @400000004e32bea00e2281e4 tcpserver: end 19433 status 256 >>> @400000004e32bea00e22f32c tcpserver: status: 3/200 >>> @400000004e32bea020c630ac tcpserver: end 19434 status 256 >>> @400000004e32bea020c63c64 tcpserver: status: 2/200 >>> @400000004e32bea11ed14264 tcpserver: status: 3/200 >>> @400000004e32bea11ed15204 tcpserver: pid 19449 from 203.200.117.65 >>> @400000004e32bea11edeb7b4 tcpserver: ok 19449 >>> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::3970 >>> @400000004e32bea21499cfb4 tcpserver: end 19449 status 256 >>> @400000004e32bea21499df54 tcpserver: status: 2/200 >>> @400000004e32bea312f84ce4 tcpserver: status: 3/200 >>> @400000004e32bea312f8589c tcpserver: pid 19456 from 203.200.117.65 >>> @400000004e32bea312f86454 tcpserver: ok 19456 >>> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::4024 >>> @400000004e32bea409545fd4 tcpserver: end 19456 status 256 >>> @400000004e32bea409546f74 tcpserver: status: 2/200 >>> @400000004e32bea5084443ac tcpserver: status: 3/200 >>> @400000004e32bea50844534c tcpserver: pid 19462 from 203.200.117.65 >>> @400000004e32bea508445f04 tcpserver: ok 19462 >>> ns.mozdesigners.com:196.46.2.**236:110 :203.200.117.65::4092 >>> >>> It seams to be a dos. >>> For smtp I use fail2ban. >>> Anyone knows how to block these IP using by creating a rule on >>> fail2ban? >>> >>> Regards >>> >> >> >> ------------------------------**------------------------------** >> --------------------- >> Qmailtoaster is sponsored by Vickers Consulting Group ( >> www.vickersconsulting.com) >> Vickers Consulting Group offers Qmailtoaster support and >> installations. >> If you need professional help with your setup, contact them today! >> ------------------------------**------------------------------** >> --------------------- >> Please visit qmailtoaster.com for the latest news, updates, and >> packages. >> To unsubscribe, e-mail: qmailtoaster-list-unsubscribe@** >> qmailtoaster.com <[email protected]> >> For additional commands, e-mail: qmailtoaster-list-help@** >> qmailtoaster.com <[email protected]> >> >> >> > --------------------------------------------------------------------------------- Qmailtoaster is sponsored by Vickers Consulting Group (www.vickersconsulting.com) Vickers Consulting Group offers Qmailtoaster support and installations. If you need professional help with your setup, contact them today! --------------------------------------------------------------------------------- Please visit qmailtoaster.com for the latest news, updates, and packages. To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
