J’ai fait plusieurs modifs simultanément et plusieurs IP se sont trouvées bannies qui ne l’étaient pas mais je ne pourrais garantir si c’est l’accroissement du bantime qui en est l’origine.
En réponse à tes autres suggestions:
fail2ban-client -t
OK: configuration test is successful
La réponse à fail2ban-client --dp (je ne mets pas tout pour ne pas polluer le forum):
...
['add', 'postfix-sasl', 'auto']
['set', 'postfix-sasl', 'addignoreregex', 'authentication failed: Connection lost to authentication server$']
['set', 'postfix-sasl', 'addfailregex', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[ *\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?postfix(-\\w+)?/(?:submission/|smtps/)?smtp[ds](?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?postfix(-\\w+)?/(?:submission/|smtps/)?smtp[ds](?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?warning: [-._\\w]+\\[<HOST>\\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:[ A-Za-z0-9+/:]*={0,2})?\\s*$']
['set', 'postfix-sasl', 'datepattern', '{^LN-BEG}']
['set', 'postfix-sasl', 'addjournalmatch', '_SYSTEMD_UNIT=postfix.service']
['set', 'postfix-sasl', 'addlogpath', '/var/log/mail.warn', 'head']
['set', 'postfix-sasl', 'logencoding', 'auto']
['set', 'postfix-sasl', 'maxretry', 5]
['set', 'postfix-sasl', 'findtime', '600']
['set', 'postfix-sasl', 'bantime', '3600']
['set', 'postfix-sasl', 'usedns', 'warn']
['set', 'postfix-sasl', 'ignorecommand', '']
['set', 'postfix-sasl', 'addignoreip', '127.0.0.1/8']
['set', 'postfix-sasl', 'addaction', 'iptables-multiport']
[ 'multi-set',
'postfix-sasl',
'action',
'iptables-multiport',
[ ['actionstart', '<iptables> -N f2b-postfix-sasl\n<iptables> -A f2b-postfix-sasl -j RETURN\n<iptables> -I INPUT -p tcp -m multiport --dports smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl'],
['actionstop', '<iptables> -D INPUT -p tcp -m multiport --dports smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl\n<iptables> -F f2b-postfix-sasl\n<iptables> -X f2b-postfix-sasl'],
['actionflush', '<iptables> -F f2b-postfix-sasl'],
['actioncheck', "<iptables> -n -L INPUT | grep -q 'f2b-postfix-sasl[ \\t]'"],
['actionban', '<iptables> -I f2b-postfix-sasl 1 -s <ip> -j <blocktype>'],
['actionunban', '<iptables> -D f2b-postfix-sasl -s <ip> -j <blocktype>'],
['name', 'postfix-sasl'],
['bantime', '3600'],
['port', 'smtp,465,submission,imap3,imaps,pop3,pop3s'],
['protocol', 'tcp'],
['chain', 'INPUT'],
['actname', 'iptables-multiport'],
['blocktype', 'REJECT --reject-with icmp-port-unreachable'],
['returntype', 'RETURN'],
['lockingopt', '-w'],
['iptables', 'iptables <lockingopt>'],
['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'],
['iptables?family=inet6', 'ip6tables <lockingopt>']]]
['add', 'mysqld-auth', 'auto']
...
Concernant les éventuels doublons:
rgrep postfix-sasl /etc/fail2ban/
/etc/fail2ban/jail.conf.dpkg-new:[postfix-sasl]
/etc/fail2ban/jail.conf:[postfix-sasl]