As the Wiki for fail2ban is a little less than explanatory than it could be, here are my own notes on setting up fail2ban to block pop3 attacks.

Have been seeing sample dictionary attacks on some servers for a while now from random ip addresses – eg

Sep 28 13:01:03 www vpopmail[20410]: vchkpw-pop3: vpopmail user not found www@:24.153.205.71
Sep 28 13:01:03 www vpopmail[20411]: vchkpw-pop3: vpopmail user not found web@:24.153.205.71
Sep 28 13:01:09 www vpopmail[20417]: vchkpw-pop3: vpopmail user not found web@:24.153.205.71
Sep 28 13:01:11 www vpopmail[20420]: vchkpw-pop3: vpopmail user not found web@:24.153.205.71
 

Annoying, but not realistically going to provide much of a security issue – most of the user names are the generic ones which aren’t actually in use on the servers.

As we already use fail2ban to perform basic service blocks against naughty script kiddie wannabee’s, why not have it block vpopmail attacks also.

Our mail error logs are located in /var/log/mail.log

As you saw above, the logs show the same common text for each failed login –

vchkpw-pop3: vpopmail user not found web@:24.153.205.71
 

A simple regex to identify that in the logs would look like this (as per the fail2ban wiki)

failregex = vchkpw-pop3: vpopmail user not found .*@:<HOST>$
 

First step is to create a filter for fail2ban.

Create /etc/fail2ban/filter.d/vpopmail.conf as below:

# Fail2Ban configuration file for vpopmail
#
# Author: Lawrence Sheed
#
# $Revision: 1.0 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT
#
failregex = vchkpw-pop3: vpopmail user not found .*@:<HOST>$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =
 

Second step is to add our filter to the fail2ban setup

Add this to the bottom of /etc/fail2ban/jail.conf

[vpopmail]
enabled = true
port    = pop3
filter  = vpopmail  
logpath = /var/log/mail.log
maxretry = 3
 

logpath should be amended to whatever your mail logs for vpopmail appear.
maxretry should be set to a value that you agree with.

Restart fail2ban with a: /etc/init.d/fail2ban restart
and check that it has added the filter.

tail /var/log/fail2ban.log

You should see a line like this:

2009-10-01 12:36:09,590 fail2ban.jail   : INFO   Jail ‘vpopmail’ started
 

If so, you’re all set!

Post comment

Archives

Categories

Most Popular Posts

Tags

Apache Apple Apple Mail arm7 biltong china china telecom Chinese Spyware Removal Howto coffee cool debian dns dvd firmware foscam Google hacking how to howto icp Image ipcam Kitto lg dv340 licence Mac Moganshan nc745 nuvoton outage Picture problem region free hack Resize Search Engine Optimization SEO shanghai south africa spam taobao Thoughts Time Machine Tuning uclinux video

Recent Comments

  • jocc: finally. I done the installation properly. I made a USB drive (at less 8GB) formatted wih GUID labelled...
  • Lawrence Sheed: It gets an ip address via DHCP, so you need to provide DHCP service on something like a router or...
  • Denis: I Can noit connected to cam after RESET! What is my ip by factory ?
  • Lawrence Sheed: Yes, you need to have had a license for at least one year. Thats correct. When I’m back...
  • Lawrence Sheed: First off, do a list of your partitions. in the boot loader – ls If you really have erased...

PHOTOSTREAM

loz - yamaha - IMGP0106SDIM0437SDIM0436SDIM0435SDIM0434SDIM0433SDIM0432SDIM0431SDIM0430SDIM0429SDIM0428SDIM0427SDIM0426SDIM0425SDIM0424SDIM0423SDIM0422SDIM0421