Debian Fail2Ban 安裝設定筆記

安裝
apt-get install fail2ban

設定檔
/etc/fail2ban/fail2ban.conf

check
logtarget = /var/log/fail2ban.log

cp jail.conf jail.local
修改jail.local內容就好， 原始檔不動
jail.local設定會覆蓋jail.conf

注意事項
ignoreip = 127.0.0.1/8 192.168.1.0/24 (空白區隔)
bantime = 600(秒)
maxretry = 10 (失敗幾次封鎖)

增加dovecot

[dovecot]
enabled = true
port = pop3,pop3s,imap,imaps
filter = dovecot
logpath = /var/log/dovecot (看實際 log檔放哪)
maxretry  = 10

/etc/fail2ban/filter.d/dovecot.conf
[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P\S*),.*
ignoreregex =

/etc/fail2ban/filter.d/sasl.conf

failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/ ]*={0,2})?$

=========

測規則

Example1

fail2ban-regex /var/log/dovecot /etc/fail2ban/filter.d/dovecot.conf

Example2

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf

Example3

fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/sasl.conf

postfix+dovecot+sasl建置設定筆記

apt-get install postfix,libsasl2-2,libsasl2-modules,sasl2-bin,dovecot-common,dovecot-imapd,dovecot-pop3d

修改/etc/postfix/main.cf
smtpd_sasl_auth_enable = yes

broken_sasl_auth_clients = yes
smtpd_client_restrictions = permit_sasl_authenticated
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
 
修改/etc/postfix/master.cf
取消chroot

建立/etc/postfix/sasl/smtpd.conf
log_level:3
pwcheck_method:saslautd
mech_list:PLAIN LOGIN

修改/etc/default/saslauthd
START = yes
MECHANISMS = shadow

修改/etc/dovecot/dovecot.conf
protocols = imap pop3
listen = *
disable_plaintext_auth = no
mail_location = maildir:/home/%u/Maildir

修改目錄權限/var/run/saslauthd為755 已無法正常運作
把postfix加入sasl群組來解決這個問題