Thx Dave!

 

From: Dave [mailto:[email protected]] 
Sent: Wednesday, December 07, 2011 9:21 AM
To: [email protected]
Subject: Re: [qmailtoaster] Account Break-in Attempts

 

in my /etc/fail2ban/jail.local

[vpopmail]
enabled = true
port = pop3
filter = vpopmail
action = iptables[name=pop3, port=pop3, protocol=tcp]
sendmailwhois[name=pop3,[email protected], sender=em...@adr]
logpath = /var/log/maillog
maxretry = 3
bantime = -1


Also, the vpomail.conf:
# Fail2Ban configuration file
# Author: Christoph Haas
# Modified by: Ole Johansen - CDS
# $Revision: 510 $

[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The 
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT

failregex = vchkpw-pop3: vpopmail user not found .*@: <mailto:.*@:%3cHOST>
<HOST>

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT

ignoreregex =

Hop it help.


On 12/7/2011 10:00 AM, Helmut Fritz wrote: 

I will third fail2ban.

 

But if anyone has a pop config they can share I would appreciate it.

 

From: Carlos Herrera Polo [mailto:[email protected]] 
Sent: Wednesday, December 07, 2011 7:48 AM
To: [email protected]
Subject: Re: [qmailtoaster] Account Break-in Attempts

 

fail2ban

2011/12/7 Mike Tirpak <[email protected]>

Everyone,

Logwatch has been reporting "No Such User Found" with over one thousand
failures for each name.  Of course someone is trying to find an account to
exploit.  Is there a way to block an IP address after so many failed
attempts on an account?

Thanks,
Mike

----------------------------------------------------------------------------
-----
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
  Vickers Consulting Group offers Qmailtoaster support and installations.
    If you need professional help with your setup, contact them today!
----------------------------------------------------------------------------
-----
   Please visit qmailtoaster.com for the latest news, updates, and packages.
        To unsubscribe, e-mail:
[email protected]
   For additional commands, e-mail: [email protected]




 

 

Reply via email to