-
|
I'm trying to ban IPs from logs like this:
Then I use AI to create and finally I modify the change part like this, in a new file postfix.local And I have a new config But it seems like not working. In which step I got it wrong? |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 3 replies
-
|
The current postfix filter successfully matches the given message in aggressive mode. [postfix]
mode = aggressive
backend = auto
logpath = /var/log/mail.log
enabled = trueAs for the original issue - I have no time to check your filter changes, so to test it'd principally work simply use: (and then see whether there are matches found for that REs) Otherwise take a look at 1st Q in FAQ in wiki :: How fail2ban works. And direct answer to question "What is the proper way to enhance the failregex for an existing service?": [postfix]
failregex = %(known/failregex)s
^^[^[]*\[<ADDR>\] ... some additional RE ...However if you want to use some interpolations declared in filter definition, you have to extend it in [Definition]
failregex = %(known/failregex)s
^^[^[]*\[<ADDR>\]%(_port)s... some additional RE ... |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for pointing out the solution. In my case, the installed version came from apt-get, it's not the latest version. I'm not sure if I can download the archive and overwrite into /etc/fail2ban. I copy the filter.d/postfix.conf to filter.d/postfix.local and added these regexes. Changed the mode to aggressive, not working and I use fail2ban-client -d and couldn't find the extra regex. That's the reason I'd like to know the correct way to patch an existing filter. According to your answer, seem like I can reuse the existing variables from .conf, by referring it as add more regexes by new lines. Right? Add them into |
Beta Was this translation helpful? Give feedback.
-
It doesn't say me which version you use.
My suggestion was to download only postfix filter and replace
If you copied the filter it shall definitely work (or at least show the RE in dump).
Nope. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @sebres I changed the section And The attacker use a group of hosts under a segment, with a low frequent. Is there an official way to change the IP record into /24? I asked AI, it suggested me to change the regex something like Is there an official way to optimize the detection and ban? Or if I should change the counter to a smaller one. |
Beta Was this translation helpful? Give feedback.
-
Unfortunately not, at the moment there are only experimental branches and forks. It is surely possible to change banning action to ban /24 instead of IP, but it is a bit ugly, because fail2ban would ban the IP, but action - the subnet, what may have consequences, for instance if two IPs of the same subnet get banned, but 2 a bit later than 1, the unban of 1st will unban the subnet (so both IPs), but 2nd IP is still banned in fail2ban (so situation with "already banned" warnings in fail2ban.log is preprogrammed and the longer it works, the more of them one'd see).
Wrong. The RE has nothing to do with subnet banning, moreover - the IP would be incorrect (missing
At the moment, not really.
Well, you can try |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for your patience! And your answer is really well and clear. I think the root to enhance fail2ban is to add a new feature. For example, add a configuration in All found IP will be saved into db with the subnet mask like But it is a huge change to the core module, hope you team will schedule such a new feature. I changed my configuration the find time and the ban time to 1h. And I can see the ban time in increment, so funny. Fail2ban is a great service, lightful and easy to extend. Thank you to make this good. |
Beta Was this translation helpful? Give feedback.
-
|
FWIW: I detected the same attacker (dictionary attack against postfix SMTPS authentication) and ended up by permanently adding 81.30.107.0/24 to my firewall's drop zone (system using firewalld). |
Beta Was this translation helpful? Give feedback.
It doesn't say me which version you use.
My suggestion was to download only postfix filter and replace
/etc/fail2ban/filter.d/postfix.conf(or put it aspostfix.local). The version of filter shall be compatible to stock 1.0 or 0.11 (but of course you must test it on your system, e. g. with fail2ban-regex).If you copied the filter it shall definitely work (or at least show the RE in dump).
Something is still wrong in your jail definition.