1

i have set up ufw in linux mint and works fine.

in my linux mint box i run dovecot and i see many failure login tries.

I set up fail2ban like this:

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,imap", protocol=tcp]
logpath = /var/log/
maxretry = 2
findtime = 1200
bantime = 1200

in /etc/fail2ban/filter.d/dovecot-pop2imap.conf i put this line:

[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=`<HOST>`

Failure login tries keep continue. Any suggestion?

1 Answer 1

1

The logpath directive should point to the actual log file, not just a directory. You can use wildcards contain * or ?, but fail2ban will only generate the list of matching files on startup.

You also seem to be doing a lot more work than needed. Most distros probably come with default rules that would handle more cases. For example, Debian has /etc/fail2ban/filter.d/dovecot.conf that defines the failregex, and the jail is defined in /etc/fail2ban/jail.conf:

[dovecot]

port    = pop3,pop3s,imap,imaps,submission,465,sieve
logpath = %(dovecot_log)s
backend = %(dovecot_backend)s

dovecot_log ultimately points to /var/log/mail.log (if not using journald). If you have a log_path defined in your Dovecot config, you may need to point it to that file.

Since Mint is based on Ubuntu, which is based on Debian, I'd expect it to have these default configs. You can enable the config by creating /etc/fail2ban/jail.local and just override the necessary parameters with something like this:

[dovecot]
enabled  = true
maxretry = 2
findtime = 20m
bantime  = 20m

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .