Using latest build (0.8.8) on CentOS i've setup fail2ban to filter Kerio spam/harvest attacks.
Here's my kerio.conf
[INCLUDES] before = common.conf [Definition] failregex = .*SMTP connection from <HOST> rejected: directory harvest attack.*$ .*SMTP Spam attack detected from <HOST>, client closed connection before SMTP greeting.*$ ignoreregex =
And my jail.conf:
[kerio] enabled = true filter = kerio logpath = /var/log/maillog action = iptables-multiport[name=kerio, port="imap,smtp,imaps,smtps,submission", protocol=tcp] sendmail-whois[name=Kerio, email@example.com, firstname.lastname@example.org] bantime = 1200 ; 1 week findtime = 600 ; 1 day maxretry = 5
iptables is up and running
# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination fail2ban-kerio tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 143,25,993,465,587 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain fail2ban-kerio (1 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0
When I run :
fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/kerio.conf
I get lot of results::
Date template hits: 5602 hit(s): MONTH Day Hour:Minute:Second Success, the total number of match is 640
I've even turned loglevel to 4 (debug) still nothing in fail2ban.log, nowhere.
I'm pulling my hairs out; can't figure out what's wrong.