On 12/08/11 0:21, Dave wrote:
in my /etc/fail2ban/jail.local
[vpopmail]
enabled = true
port = pop3
filter = vpopmail
action = iptables[name=pop3, port=pop3, protocol=tcp]
sendmailwhois[name=pop3,[email protected], sender=em...@adr]
logpath = /var/log/maillog
maxretry = 3
bantime = -1
Also, the vpomail.conf:
# Fail2Ban configuration file
# Author: Christoph Haas
# Modified by: Ole Johansen - CDS
# $Revision: 510 $
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the
logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>\S+)
# Values: TEXT
failregex = vchkpw-pop3: vpopmail user not found .*@:<HOST>
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
ignoreregex =
Hop it help.
Dave,
Could you mind add this fail2ban rule on
http://wiki.qmailtoaster.com/index.php/Fail2Ban
if your rule is not listed there. so it can secure other qmt box as well
I am still confuse regarding fail2ban rule and config.
