Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I set up fail2ban so that all those pesky pop3 login attempts are taken care of? I am using Ubuntu 9.04 and here's an extract from the pop3 log as I see it in the mails that Logwatch sends:

   LOGIN FAILED, user=Administrador, ip=[::ffff:]: 8 Time(s)
   LOGIN FAILED, user=Alfredo, ip=[::ffff:]: 8 Time(s)
   LOGIN FAILED, user=Antonio, ip=[::ffff:]: 6 Time(s)
   LOGIN FAILED, user=Carmelo, ip=[::ffff:]: 8 Time(s)
   LOGIN FAILED, user=access, ip=[::ffff:]: 7 Time(s)
   LOGIN FAILED, user=account, ip=[::ffff:]: 7 Time(s)
   LOGIN FAILED, user=admin, ip=[::ffff:]: 5 Time(s)
   LOGIN FAILED, user=angel, ip=[::ffff:]: 9 Time(s)

EDIT: I think the solution is to simply change the settings in /etc/fail2ban/jail.conf by enabling courier related jails. Could someone verify this?

share|improve this question

I don't like "fail2ban" because it "lives" in userland and has a lot of "moving parts". If you're using iptables on the machine it's fairly trivial to rate-limit new connections from the same IP address.

iptables -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --update --seconds 60 --hitcount 5 -j DROP
iptables -A INPUT -p tcp --dport 110 -m state --state NEW -m recent --name pop --rsource --set -j ACCEPT

Assuming you've got higher-up rules in the INPUT chain to allow ESTABLISHED connections through these rules will work to rate-limit incoming new TCP connections to your POP3 port (exceeding 5 in 60 seconds).

share|improve this answer
The OP is (was, actually) probably suffering a brute-force attack. Rate-limiting connections is a good practice, but not a good brute-force prevention technique. IDS is the way to go here. Userland log analysis with fail2ban is the next best option. – GnP Nov 28 '14 at 14:34

fail2ban is quite flexible, it can react to any expressions in any log files: in /etc/fail2ban/jail.conf you specify where to look (logpath), what to look for (filter) and what to do (action).

In your case you could try the existing filter /etc/fail2ban/filter.d/courierlogin.conf (check the regular expression, maybe you will need to modify it) and an existing action from /etc/fail2ban/action.d/ (see examples in /etc/fail2ban/jail.conf). For example, if you use shorewall:

enabled  = true
filter   = courierlogin
action   = shorewall
logpath  = /var/log/mail.log

I always add known good IPs to ignoreip, so these addresses don't get banned:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.