Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks.

Here's my kerio.conf

before = common.conf
failregex = .*SMTP connection from <HOST> rejected: directory harvest attack.*$
            .*SMTP Spam attack detected from <HOST>, client closed connection before SMTP greeting.*$

ignoreregex = 

And my jail.conf:


enabled  = true
filter   = kerio
logpath  = /var/log/maillog
action   = iptables-multiport[name=kerio, port="imap,smtp,imaps,smtps,submission", protocol=tcp]
           sendmail-whois[name=Kerio, dest=info@mycompany.com, sender=info@mycompany.com]
bantime  = 1200  ; 1 week
findtime = 600   ; 1 day
maxretry = 5

iptables is up and running

# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-kerio  tcp  --             multiport dports 143,25,993,465,587 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-kerio (1 references)
target     prot opt source               destination         
RETURN     all  --       

When I run :

fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/kerio.conf

I get lot of results::

Date template hits:
5602 hit(s): MONTH Day Hour:Minute:Second
Success, the total number of match is 640

I've even turned loglevel to 4 (debug) still nothing in fail2ban.log, nowhere.

I'm pulling my hairs out; can't figure out what's wrong.

share|improve this question
Did you make sure fail2ban is running? Change the backend to polling (gamin doesn't work right on Debian, at least). Check fail2ban-client status kerio to see if you're failing anyone without banning (findtime too short, e.g.). –  bonsaiviking Apr 25 '13 at 11:26
yes it's running; running client status kerio gives me '0' everywhere; although i've manually echoed sample attacks and lowered the findtime to 60, still nothing in logs, not even a single debug line except start/stop daemon alerts. –  Disco Apr 25 '13 at 11:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.