fail2ban fails to start

Thursday, January 27. 2011

I discovered loads of entries in mail.log logging dicionary attacks on port 110. And, going back in time, the logs showed more than just one dictionary being used, and it had been going for some time. Well, it litters the logs and you don't want to risk that finally one of them gets lucky with a user password so I searched for a way to stop the attacks.
I already used denyhosts against brute force attacks on ssh, which works fine but is limited to ssh. Instead I found out about fail2ban. 

It does what I need now but it took some smoothing of edges till I got there.

debian lenny, python 2.5.2 and fail2ban v 0.8.3 wouldn't play nice together. Fail2ban v0.8.3 apparently doesn't run with python2.5 but needs python2.4 instead

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496633 describes the sort of thing I experienced and I followed the workaround given there:

apt-get install python2.4
apt-get install fail2ban

now edit both /usr/bin/fail2ban-server and /usr/bin/fail2ban-client, first line, to point towards  python2.4 (and not python).

#!/usr/bin/python2.4

Now fail2ban ran but still wouldn't stop the attacks. I followed the howto at http://www.howtoforge.com/fail2ban_debian_etch and while I have found plenty of good advice on that site before and after, this one didn't just work. Additionally to the config described therein a file  filter.d/pop3d.conf was needed (which is easily supplied by 
cp courierlogin.conf pop3d.conf

Further on I had to remove a line from  jail.local until it looked like this:

[pop3d]
enabled = true
port = pop3   
filter = pop3d
logpath = /var/log/mail.log
maxretry = 5

One thing which irritated me debugging the problem was that fail2ban didn't report the errors in the log file even though I had the loglevel set up to 4. To get to see the errors I had to run two shells, running  
/usr/bin/fail2ban-server -x -f
in one of them and then 
/usr/bin/fail2ban-client reload
in the other one.

Update:

Later, I found thousands of log entries re SASL LOGIN:
Feb 10 16:55:42 pipit postfix/smtpd[21738]: warning: unknown[95.62.75.67]: SASL LOGIN authentication failed: authentication failure
Feb 10 16:55:49 pipit postfix/smtpd[21738]: warning: unknown[95.62.75.67]: SASL LOGIN authentication failed: authentication failure
Feb 10 16:55:56 pipit postfix/smtpd[21738]: warning: unknown[95.62.75.67]: SASL LOGIN authentication failed: authentication failure

There was a filter for SASL in the config but it didn't seem to catch them. Google once again found prior art  and the regexp from there did the job:

 failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w



Trackbacks


Trackback specific URI for this entry
    No Trackbacks

Comments


    #1 Martin on 09/17/11 at 03:31 AM
    Wenn man Fail2Ban einsetzt, kann man auch automatisch über mein Projekt https://www.blocklist.de/de/ die Angreifer reporten und entsprechend anonym melden.
    Es gibt auch Statistiken, Whitelists und einige andere nette Sachen.

    Mfg Martin

Add Comment

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA