Bonjour,
Cela fait peu de temps que j’ai mis en place un fail2ban et je constate qu’il n’est pas opérationnel surtout pour mes mails.
J’utilise un container openvz en Jessie 8.7 avec fail2ban 0.8.13-1.
fail2ban-client status sasl
Status for the jail: sasl
|- filter
| |- File list: /var/log/mail.log
| |- Currently failed: 4
|- Total failed: 7897- action
|- Currently banned: 0
|- IP list:- Total banned: 1
Quand j’exécute la regex sur un petit extrait de mon log :
fail2ban-regex /tmp/toto /etc/fail2ban/filter.d/postfix-sasl.conf
Results
Failregex: 1 total
|- #) [# of hits] regular expression
| 1) [1] ^\s*(<[^.]+.[^.]+>)?\s*(?:\S+ )?(?:kernel: [ \d+.\d+] )?(?:@vserver_\S+ )?(?:(?:[\d+])?:\s+[[(]?postfix/smtpd(?:(\S+))?[])]?:?|[[(]?postfix/smtpd(?:(\S+))?[])]?:?(?:[\d+])?:?)?\s(?:[ID \d+ \S+])?\swarning: [-._\w]+[]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]={0,2})?\s$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [5] MONTH Day Hour:Minute:Second
`-
Lines: 5 lines, 0 ignored, 1 matched, 4 missed
|- Missed line(s):
| Mar 31 09:58:53 mail postfix/smtpd[7710]: warning: hostname systemip3.example.com does not resolve to address 91.200.12.134: Name or service not known
| Mar 31 09:58:53 mail postfix/smtpd[7710]: connect from unknown[91.200.12.134]
| Mar 31 09:58:54 mail postfix/smtpd[7710]: lost connection after AUTH from unknown[91.200.12.134]
| Mar 31 09:58:54 mail postfix/smtpd[7710]: disconnect from unknown[91.200.12.134]
`-
J’ai l’impression d’avoir une ligne qui match mais il ne trouve pas l’adresse pour la bannir.
Mon extrait de log : /tmp/toto
Mar 31 09:58:53 mail postfix/smtpd[7710]: warning: hostname systemip3.example.com does not resolve to address 91.200.12.134: Name or service not known
Mar 31 09:58:53 mail postfix/smtpd[7710]: connect from unknown[91.200.12.134]
Mar 31 09:58:54 mail postfix/smtpd[7710]: warning: unknown[91.200.12.134]: SASL LOGIN authentication failed: authentication failure
Mar 31 09:58:54 mail postfix/smtpd[7710]: lost connection after AUTH from unknown[91.200.12.134]
Mar 31 09:58:54 mail postfix/smtpd[7710]: disconnect from unknown[91.200.12.134]
Ma règle :
failregex = ^%(__prefix_line)swarning: [-._\w]+[]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]={0,2})?\s$
Avez-vous une piste à me conseiller ?