# Recidive fail2ban

**URL:** <https://www.debian-fr.org/t/recidive-fail2ban/80355>\
**Category:** Support Debian\
**Created:** [Octobre 7, 2019, 9:35 UTC](https://www.debian-fr.org/t/recidive-fail2ban/80355 "2019-10-07T09:35:30Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![kmchen](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/k/3d9bf3/32.png) [@kmchen](https://www.debian-fr.org/u/kmchen)\
**Post date:** [Octobre 8, 2019, 10:35 UTC](https://www.debian-fr.org/t/recidive-fail2ban/80355/5 "2019-10-08T10:35:14Z")

</div>

> [@](#):
>
> Est-ce que tu as constaté une différence après cette modification ?

J’ai fait plusieurs modifs simultanément et plusieurs IP se sont trouvées bannies qui ne l’étaient pas mais je ne pourrais garantir si c’est l’accroissement du bantime qui en est l’origine.

En réponse à tes autres suggestions:

```
fail2ban-client -t
OK: configuration test is successful

```

La réponse à fail2ban-client --dp (je ne mets pas tout pour ne pas polluer le forum):

```
...
['add', 'postfix-sasl', 'auto']
['set', 'postfix-sasl', 'addignoreregex', 'authentication failed: Connection lost to authentication server$']
['set', 'postfix-sasl', 'addfailregex', '^(?:\\[\\])?\\s*(?:<[^.]+\\.[^.]+>\\s+)?(?:\\S+\\s+)?(?:kernel: \\[*\\d+\\.\\d+\\]\\s+)?(?:@vserver_\\S+\\s+)?(?:(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?postfix(-\\w+)?/(?:submission/|smtps/)?smtp[ds](?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?postfix(-\\w+)?/(?:submission/|smtps/)?smtp[ds](?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)\\s+)?(?:\\[ID \\d+ \\S+\\]\\s+)?warning: [-._\\w]+\\[<HOST>\\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:[A-Za-z0-9+/:]*={0,2})?\\s*$']
['set', 'postfix-sasl', 'datepattern', '{^LN-BEG}']
['set', 'postfix-sasl', 'addjournalmatch', '_SYSTEMD_UNIT=postfix.service']
['set', 'postfix-sasl', 'addlogpath', '/var/log/mail.warn', 'head']
['set', 'postfix-sasl', 'logencoding', 'auto']
['set', 'postfix-sasl', 'maxretry', 5]
['set', 'postfix-sasl', 'findtime', '600']
['set', 'postfix-sasl', 'bantime', '3600']
['set', 'postfix-sasl', 'usedns', 'warn']
['set', 'postfix-sasl', 'ignorecommand', '']
['set', 'postfix-sasl', 'addignoreip', '127.0.0.1/8']
['set', 'postfix-sasl', 'addaction', 'iptables-multiport']
[ 'multi-set',
  'postfix-sasl',
  'action',
  'iptables-multiport',
  [['actionstart', '<iptables> -N f2b-postfix-sasl\n<iptables> -A f2b-postfix-sasl -j RETURN\n<iptables> -I INPUT -p tcp -m multiport --dports smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl'],
    ['actionstop', '<iptables> -D INPUT -p tcp -m multiport --dports smtp,465,submission,imap3,imaps,pop3,pop3s -j f2b-postfix-sasl\n<iptables> -F f2b-postfix-sasl\n<iptables> -X f2b-postfix-sasl'],
    ['actionflush', '<iptables> -F f2b-postfix-sasl'],
    ['actioncheck', "<iptables> -n -L INPUT | grep -q 'f2b-postfix-sasl[\\t]'"],
    ['actionban', '<iptables> -I f2b-postfix-sasl 1 -s <ip> -j <blocktype>'],
    ['actionunban', '<iptables> -D f2b-postfix-sasl -s <ip> -j <blocktype>'],
    ['name', 'postfix-sasl'],
    ['bantime', '3600'],
    ['port', 'smtp,465,submission,imap3,imaps,pop3,pop3s'],
    ['protocol', 'tcp'],
    ['chain', 'INPUT'],
    ['actname', 'iptables-multiport'],
    ['blocktype', 'REJECT --reject-with icmp-port-unreachable'],
    ['returntype', 'RETURN'],
    ['lockingopt', '-w'],
    ['iptables', 'iptables <lockingopt>'],
    ['blocktype?family=inet6', 'REJECT --reject-with icmp6-port-unreachable'],
    ['iptables?family=inet6', 'ip6tables <lockingopt>']]]
['add', 'mysqld-auth', 'auto']
...

```

Concernant les éventuels doublons:

```
rgrep postfix-sasl /etc/fail2ban/
/etc/fail2ban/jail.conf.dpkg-new:[postfix-sasl]
/etc/fail2ban/jail.conf:[postfix-sasl]
```

---

_[View the full topic](https://www.debian-fr.org/t/recidive-fail2ban/80355)._