Quantcast
Channel: iRedMail
Viewing all articles
Browse latest Browse all 14103

fail2log's jail not functioning

$
0
0

======== Required information ====
- iRedMail version: 0.9.0
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): LDAP
- Linux/BSD distribution name and version: Ubuntu 14.04
- Related log if you're reporting an issue:
====

We are using SOGo, and no Roundcube is installed.

Our fail2ban service works properly but something is preventing the jail getting read:

 14:55:36,600 fail2ban.server : INFO   Stopping all jails
 14:55:36,792 fail2ban.jail   : INFO   Jail 'roundcube-iredmail' stopped
 14:55:37,786 fail2ban.actions.action: ERROR  iptables -D INPUT -p tcp -j fail2ban-default
iptables -F fail2ban-default
iptables -X fail2ban-default returned 100
 14:55:37,788 fail2ban.jail   : INFO   Jail 'sshd' stopped
 14:55:38,685 fail2ban.jail   : INFO   Jail 'postfix-iredmail' stopped
 14:55:38,786 fail2ban.jail   : INFO   Jail 'dovecot-iredmail' stopped
 14:55:39,684 fail2ban.jail   : INFO   Jail 'sshd-ddos' stopped
 14:55:39,697 fail2ban.server : INFO   Exiting Fail2ban

iptables -n -L INPUT | grep -q fail2ban-ssh gives nothing:

# iptables -n -L INPUT | grep -q fail2ban-ssh
# 

and this is my jail.local file:

# Refer to /etc/fail2ban/jail.conf for more examples.
[DEFAULT]
maxretry    = 5
# time is in seconds. 3600 = 1 hour
findtime    = 300
bantime     = 3600
ignoreip    = 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16

[sshd]
enabled     = true
filter      = sshd
action      = iptables-allports
logpath     = /var/log/auth.log

[sshd-ddos]
enabled     = true
filter      = sshd-ddos
action      = iptables-allports
logpath     = /var/log/auth.log

[roundcube-iredmail]
enabled     = true
filter      = roundcube.iredmail
action      = iptables-multiport[name=roundcube, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/log/mail.log
findtime    = 3600

[dovecot-iredmail]
enabled     = true
filter      = dovecot.iredmail
action      = iptables-multiport[name=dovecot, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/log/dovecot.log

[postfix-iredmail]
enabled     = true
filter      = postfix.iredmail
action      = iptables-multiport[name=postfix, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
#              sendmail[name=Postfix, dest=root, sender=fail2ban@localhost]
logpath     = /var/log/mail.log

Any clues or suggestions we could diagnose the problem?

Thanks.


Viewing all articles
Browse latest Browse all 14103

Trending Articles