forum.lissyara.su

Код: Выделить всё

Jul 14 06:38:08 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<aerial>, method=PLAIN, rip=66.212.1.254, lip=10.0.0.227
Jul 14 06:38:09 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<agent>, method=PLAIN, rip=66.212.1.254, lip=10.0.0.227
Jul 14 06:38:10 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<alec>, method=PLAIN, rip=66.212.1.254, lip=10.0.0.227
Jul 14 06:38:10 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<alexa>, method=PLAIN, rip=66.212.1.254, lip=10.0.0.227
Jul 14 06:38:11 mail dovecot: pop3-login: Aborted login (auth failed, 1 attempts): user=<alexandria>, method=PLAIN, rip=66.212.1.254, lip=10.0.0.227

Код: Выделить всё

begin authenticators


# outlook or netscape

auth_plain:
  driver = plaintext
  public_name = PLAIN
  server_condition = ${lookup mysql{SELECT `username` FROM `mailbox` WHERE `username` = '${quote_mysql:$auth2}' AND `password` = '${quote_mysql:$auth3}'}{yes}{no}}
  server_prompts = :
  server_set_id = $auth2

# outlook or netscape

auth_login:
  driver = plaintext
  public_name = LOGIN
  server_condition = ${lookup mysql{SELECT `username` FROM `mailbox` WHERE `username` = '${quote_mysql:$auth1}' AND `password` = '${quote_mysql:$auth2}'}{yes}{no}}
  server_prompts = Username:: : Password::
  server_set_id = $auth1

# the bat

auth_cram_md5:
  driver = cram_md5
  public_name = CRAM-MD5
  server_secret = ${lookup mysql{SELECT `password` FROM `mailbox` WHERE `username`  = '${quote_mysql:$auth1}'}{$value}fail}
  server_set_id = $auth2

Код: Выделить всё

# block the pop3 bruteforce
block drop in quick on $ext_if proto tcp from <pop3-bruteforce> to port pop3
pass in on $ext_if proto tcp from any to ($ext_if) port pop3 flags S/SA keep state (max-src-conn-rate 15/60, overload <pop3-bruteforce> flush)

Код: Выделить всё

# clear firewall table with pop3-bruteforce
*/2     *       *       *       *       /usr/local/sbin/expiretable -t 600 pop3-bruteforce

Код: Выделить всё

pfctl -t pop3-bruteforce -T flush

Код: Выделить всё

[Definition]
actionstart =
actionstop =
actioncheck =
actionban = ipfw table 1 add <ip>
actionunban = ipfw table 1 delete <ip>
[Init]
port = pop3
localhost = 127.0.0.1

Код: Выделить всё

[Definition]
failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
ignoreregex =

Код: Выделить всё

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 629 $
#

[Definition]

# Option:  loglevel
# Notes.:  Set the log level output.
#          1 = ERROR
#          2 = WARN
#          3 = INFO
#          4 = DEBUG
# Values:  NUM  Default:  3
#
loglevel = 3

# Option:  logtarget
# Notes.:  Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.
#          Only one log target can be specified.
# Values:  STDOUT STDERR SYSLOG file  Default:  /var/log/fail2ban.log
#
logtarget = /var/log/fail2ban.log

# Option: socket
# Notes.: Set the socket file. This is used to communicate with the daemon. Do
#         not remove this file when Fail2ban runs. It will not be possible to
#         communicate with the server afterwards.
# Values: FILE  Default:  /var/run/fail2ban/fail2ban.sock
#
socket = /var/run/fail2ban/fail2ban.sock

Код: Выделить всё

[DEFAULT]
ignoreip = 127.0.0.1
backend = auto
findtime = 1200
bantime = 1200
maxretry = 2

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = ipfw[localhost=10.0.0.227]
logpath = /var/log/maillog
ignoreip = 10.0.0.227

Код: Выделить всё

2010-07-15 13:44:47,320 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 10.0.0.12
2010-07-15 14:04:47,461 fail2ban.actions: WARNING [dovecot-pop3imap] Unban 10.0.0.12
2010-07-15 14:09:33,209 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 10.0.0.12
2010-07-15 14:29:33,350 fail2ban.actions: WARNING [dovecot-pop3imap] Unban 10.0.0.12
2010-07-15 14:34:22,107 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 10.0.0.12
2010-07-15 14:54:22,248 fail2ban.actions: WARNING [dovecot-pop3imap] Unban 10.0.0.12
2010-07-15 15:00:24,195 fail2ban.actions: WARNING [dovecot-pop3imap] Ban 10.0.0.12
2010-07-15 15:20:24,336 fail2ban.actions: WARNING [dovecot-pop3imap] Unban 10.0.0.12