Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Hey Iv been working with this on my vps and the above wasnt quite working for me. So heres what I used.
- squid.conf
- # Fail2Ban configuration file for squid
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [INCLUDES]
- # Read common prefixes. If any customizations available -- read them from
- # common.local
- before = common.conf
- [Definition]
- _daemon = squid
- # Option: failregex
- # Notes.: regex to match the password failures messages in the logfile. The
- # host must be matched by a group named "host". The tag "<HOST>" can
- # be used for standard IP/hostname matching and is only an alias for
- # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
- # Values: TEXT
- #
- failregex = \d{0,10}.*\d{0,3}\ .* \ \d <HOST> TCP_DENIED\/407 .*$
- # Option: ignoreregex
- # Notes.: regex to ignore. If this regex matches, the line is ignored.
- # Values: TEXT
- #
- ignoreregex =
- [edit] Qmail vpopmail imap ssl filter
- Jail
- [qmail-vpopmail-imap-ssl-pw-fail]
- enabled = true
- filter = qmail-vpopmail-imap-ssl-password.conf
- action = iptables[name=IMAP, port="143,585,993", protocol=tcp]
- logpath = /var/log/imap4-ssl/current
- maxretry = 5
- bantime = 864000
- findtime = 3600
- Filter
- # Fail2Ban configuration file
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- #Looks for failed password logins to SMTP
- failregex = ^@\w{1,30} ERR: LOGIN FAILED, ip=.<HOST>.$
- ignoreregex =
- [edit] Qmail vpopmail imap filter
- Jail
- [qmail-vpopmail-imap-pw-fail]
- enabled = true
- filter = qmail-vpopmail-imap-password.conf
- action = iptables[name=IMAP, port="143,585,993", protocol=tcp]
- logpath = /var/log/imap4/current
- maxretry = 5
- bantime = 864000
- findtime = 3600
- Filter
- # Fail2Ban configuration file
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- #Looks for failed password logins to SMTP
- failregex = ^@\w{1,30} ERR: LOGIN FAILED, ip=.<HOST>.$
- ignoreregex =
- [edit] Qmail vpopmail smtp filter
- Jail information
- [qmail-vpopmail-smtp-pw-fail]
- enabled = true
- filter = qmail-vpopmail-smtp-password
- action = iptables[name=SMTP, port="25,465", protocol=tcp]
- logpath = /var/log/maillog
- maxretry = 5
- bantime = 864000
- findtime = 3600
- [qmail-vpopmail-smtp-user-notfound]
- enabled = true
- filter = qmail-vpopmail-smtp-username
- action = iptables[name=SMTP, port="25,465" protocol=tcp]
- logpath = /var/log/maillog
- maxretry = 5
- bantime = 864000
- findtime = 3600
- # Fail2Ban configuration file
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- # Option: failregex
- # Notes.: regex to match the password failures messages in the logfile.
- # The host must be matched by a group named "host". The tag "<HOST>" can
- # be used for standard IP/hostname matching and is only an alias for
- # (?:::f{4,6}:)?(?P<host>\S+)
- # Values: TEXT
- failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-smtp: vpopmail user not found \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
- # Option: ignoreregex
- # Notes.: regex to ignore. If this regex matches, the line is ignored.
- # Values: TEXT
- ignoreregex =
- # Fail2Ban configuration file
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- #Looks for failed password logins to SMTP
- failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-smtp: password fail \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
- ignoreregex =
- [edit] Qmail vpopmail pop3 filter
- Heres the jail
- [qmail-vpopmail-pop3-user-notfound]
- enabled = true
- filter = qmail-vpopmail-pop3-username
- action = iptables[name=POP3, port="110,995" protocol=tcp]
- logpath = /var/log/maillog
- maxretry = 5
- bantime = 864000
- findtime = 3600
- Heres the filter
- # Fail2Ban configuration file
- #
- # Author: Jacke Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- # Option: failregex
- # Notes.: regex to match the password failures messages in the logfile.
- # The host must be matched by a group named "host". The tag "<HOST>" can
- # be used for standard IP/hostname matching and is only an alias for
- # (?:::f{4,6}:)?(?P<host>\S+)
- # Values: TEXT
- failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-pop3: vpopmail user not found \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
- # Option: ignoreregex
- # Notes.: regex to ignore. If this regex matches, the line is ignored.
- # Values: TEXT
- ignoreregex =
- [qmail-vpopmail-pop3-pw-fail]
- enabled = true
- filter = qmail-vpopmail-password
- action = iptables[name=POP3, port="110,995", protocol=tcp]
- logpath = /var/log/maillog
- maxretry = 5
- bantime = 864000
- findtime = 3600
- # Fail2Ban configuration file
- #
- # Author: Jackie Craig Sparks
- #
- # $Revision: 728 $
- #
- [Definition]
- #Looks for failed password logins to pop3
- failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-pop3: password fail \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
- ignoreregex =
Advertisement
Add Comment
Please, Sign In to add comment