Differences

This shows you the differences between two versions of the page.

--- vms:webdev:ispconfig [2014/06/06 15:21]
admin [Vlogger, Webalizer, And AWstats]
+++ vms:webdev:ispconfig [2014/06/06 15:40]
admin [fail2ban]
@@ Line 352: / Line 352: @@
 ==== fail2ban ====
 ----
+<code>
+> apt-get install fail2ban
+</code>
+To have fail2ban monitor PureFTPd and Dovecot, create (or edit) the file **/etc/fail2ban/jail.local**:
+<code>
+> nano /etc/fail2ban/jail.local
+[pureftpd]
+enabled  = true
+port     = ftp
+filter   = pureftpd
+logpath  = /var/log/syslog
+maxretry = 3
+[dovecot-pop3imap]
+enabled = true
+filter = dovecot-pop3imap
+action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
+logpath = /var/log/mail.log
+maxretry = 5
+[sasl]
+enabled  = true
+port     = smtp
+filter   = sasl
+logpath  = /var/log/mail.log
+maxretry = 3
+</code>
+Create two more files:
+<code>
+> nano /etc/fail2ban/filter.d/pureftpd.conf
+[Definition]
+failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
+ignoreregex =
+> nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf
+[Definition]
+failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.*
+ignoreregex =
+</code>