Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just got a barrage of pop3-login attacks on one of my servers. I was surprised that fail2ban wasn't stopping them, then I realized that the service is listening on multiple IP addresses, and the attacker was spraying over all of them. Fail2ban only blocked my first IP.

fail2ban has a myip=x.y.z.a setting, but it doesn't seem to take multiple values. Is there a way to set this up?

share|improve this question
1  
Could you move that edit to an Answer? You have correctly identified the "problem". –  Chris S Jul 27 '12 at 14:34
add comment

1 Answer

up vote 0 down vote accepted

D'oh! bad assumption on my part. I had a close look. fail2ban doesn't block on the local IP, it's blocking the source properly. It is not necessary to configure multiple IP addresses.

The issue seems to be that they were doing dozens of attempts per second.

2012-07-26 10:41:25,771 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 74.63.241.177
2012-07-26 10:41:27,825 fail2ban.actions: WARNING [dovecot-pop3imap] 74.63.241.177   already banned
2012-07-26 10:41:28,827 fail2ban.actions: WARNING [dovecot-pop3imap] 74.63.241.177 already banned
2012-07-26 10:41:30,829 fail2ban.actions: WARNING [dovecot-pop3imap] 74.63.241.177 already banned

It was enough to ramp up the process count before fail2ban could respond. The volume of the attack and the spread over multiple IPs caught me off guard.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.