Fail2Ban 无法阻止对 dovecot 的暴力攻击

Question

官方fail2ban 维基对如何测试正则表达式有一些很好的说明。

更具体地说，您应该fail2ban-regex针对日志（的样本）进行运行。

# fail2ban-regex /var/log/dovecot-info.log /etc/fail2ban/filter.d/dovecot.conf

此外，您的配置似乎存在错误：

[dovecot-pop3imap]
  enabled  = true
  filter   = dovecot-pop3imap

因为过滤器的名称应该与文件的名称相匹配/etc/fai2ban/filters.d

我测试了您的日志样本，具体来说：

Feb 22 21:48:21 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.111.111.111

第一次尝试失败：

# fail2ban-regex sample.log /etc/fail2ban/filter.d/dovecot-pop3imap.conf

Running tests
=============

No section headers in /etc/fail2ban/filter.d/dovecot-pop3imap.conf

在向正则表达式指令添加[Definition]标签后（为了简洁起见，您也可以省略它），输出为：

# fail2ban-regex sample.log /etc/fail2ban/filter.d/dovecot-pop3imap.conf --print-all-missed

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/dovecot-pop3imap.conf
Use         log file : sample.log
Use         encoding : UTF-8


Results
=======

Failregex: 1 total
|-  #) [# of hits] regular expression
|   1) [1] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?|[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [1] MON Day 24hour:Minute:Second
`-

Lines: 1 lines, 0 ignored, 1 matched, 0 missed

另请注意，您的正则表达式无法编译（我还没有尝试调试原因）。我使用了fail2ban自带的正则表达式：

# rpm -qi fail2ban
Name        : fail2ban
Version     : 0.9
Release     : 0.3.git1f1a561.fc20

稍有不同：

failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$

Answer 1