Re: [qmailtoaster] re: hack attempts

cj yother Thu, 20 Feb 2014 08:29:33 -0800

I see you all are experiencing basically what I am. I have Fail2Ban installed with e mail notifications and that's what brought it to my attention. I usually see 3 or 4 attempts a day and over the past few days it's been 30 to 40.

What helped me the most once my Fail2Ban was installed was testing it against your log files that included attacks. Like so.

fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/your-filter.conf

This really nails down that's it working as desired.

Then check if they're getting banned # iptables -L -n -v

Chain fail2ban-sasl (1 references)
pkts bytes target     prot opt in     out     source               destination
   10   400 DROP       all -- *      *       87.139.213.236       0.0.0.0/0
   15   694 DROP       all -- *      *       217.39.170.225       0.0.0.0/0
   12   605 DROP       all -- *      *       178.41.243.140       0.0.0.0/0
   16   904 DROP       all -- *      *       186.215.174.252      0.0.0.0/0
   17   875 DROP       all -- *      *       67.79.217.54         0.0.0.0/0
    2   101 DROP       all -- *      *       12.236.34.135        0.0.0.0/0
   22 1276 DROP       all -- *      *       209.252.14.93        0.0.0.0/0

I am somewhat glad to hear I'm not the only one seeing this uptick.

Cheers

CJ

On 02/20/2014 08:14 AM, Dave M wrote:

I installed long time ago from this guide
and tweeked it for my needs.
http://wiki.qmailtoaster.com/index.php/Fail2Ban

Dave M

On 2/20/2014 9:10 AM, Angus McIntyre wrote:

Dan McAllister wrote:

Angus -- would you mind sharing with the group how you implemented the
fail2ban on your system. It should probably go into the WIKI (if its not
already there -- too lazy to check just now).

I added a write-up of the things that have worked for me at:

http://wiki.qmailtoaster.com/index.php/Hardening_your_toaster#Implementing_fail2ban

I am not an expert, so I'd appreciate it if people with more system
administration chops than me could check/try this and correct any flagrant
mistakes I've made.

Angus

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Re: [qmailtoaster] re: hack attempts

Reply via email to