Re: fail2ban problem

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Wed, Apr 10, 2013 at 6:06 AM, Nikos Gatsis - Qbit <ngatsis@xxxxxxx>wrote:

> Hello list
> I'm trying to setup fail2ban specially sasl action but I'm facing problems.
> I have centos-release-5-9.el5.centos.1
> and
> fail2ban-0.8.7.1-1.el5.rf
>

I'm using fail2ban from EPEL since I didn't have any luck with the package
from RPMForge.  I standardize on using EPEL if I can (but another admin
installed the rpmforge repo earlier).

I had to tweak the regex for the sasl filter to get it to match failed sasl
auth attempts though (EPEL package).

]# grep failregex /etc/fail2ban/filter.d/sasl.conf
# Option: failregex
#failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:
[A-Za-z0-9+/]*={0,2})?$
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:
[A-Za-z0-9+/\s]*={0,2})?$



> installed
> with selinux disabled
>
> The errors I get are:
> INFO   Creating new jail 'sasl-iptables'
> fail2ban.comm   : WARNING Invalid command: ['add', 'sasl-iptables',
> 'polling']
>

I believe this is exactly what I saw before I bailed on the rpmforge
fail2ban packages.


>
> I tried gemin against polling but I get the same error.
>

You don't need to set it to gamin ... the sasl jail (by default) is set to
polling (and this works with the EPEL package).


> The strange thing is that if I enable ssh action, starts with no problem.
> So it appears to be problem with sasl action, witch is:
>
> [sasl-iptables]
>
> enabled  = true
> filter   = sasl
> backend  = polling
> action   = iptables-multiport[name=sasl,
> port="imap,imaps,pop3,pop3s,smtp", protocol=tcp]
>            sendmail-whois[name=sasl, dest=my@email]
> logpath  = /var/log/maillog
>
> The same setup I have in several mailserver (fedora and centos 6 distro)
> and all work fine.
>
> Does someone faced the same problem?
>
> Thak you in advance.
>
> --
> Untitled Document
> ------------------------------------------------------------------------
> *Γατσής Νίκος - Gatsis Nikos*
> Web developer
> tel.: 2108256721 - 2108256722
> fax: 2108256712
> email: ngatsis@xxxxxxx
> http://www.qbit.gr
> _______________________________________________
> CentOS mailing list
> CentOS@xxxxxxxxxx
> http://lists.centos.org/mailman/listinfo/centos
>



-- 
---~~.~~---
Mike
//  SilverTip257  //
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos





[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux