skraps

Fail2ban filters

Aug 18th, 2011
400
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.42 KB | None | 0 0
  1. Hey Iv been working with this on my vps and the above wasnt quite working for me. So heres what I used.
  2. squid.conf
  3. # Fail2Ban configuration file for squid
  4. #
  5. # Author: Jackie Craig Sparks
  6. #
  7. # $Revision: 728 $
  8. #
  9. [INCLUDES]
  10. # Read common prefixes. If any customizations available -- read them from
  11. # common.local
  12. before = common.conf
  13. [Definition]
  14. _daemon = squid
  15. # Option: failregex
  16. # Notes.: regex to match the password failures messages in the logfile. The
  17. # host must be matched by a group named "host". The tag "<HOST>" can
  18. # be used for standard IP/hostname matching and is only an alias for
  19. # (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
  20. # Values: TEXT
  21. #
  22. failregex = \d{0,10}.*\d{0,3}\ .* \ \d <HOST> TCP_DENIED\/407 .*$
  23. # Option: ignoreregex
  24. # Notes.: regex to ignore. If this regex matches, the line is ignored.
  25. # Values: TEXT
  26. #
  27. ignoreregex =
  28. [edit] Qmail vpopmail imap ssl filter
  29. Jail
  30. [qmail-vpopmail-imap-ssl-pw-fail]
  31. enabled = true
  32. filter = qmail-vpopmail-imap-ssl-password.conf
  33. action = iptables[name=IMAP, port="143,585,993", protocol=tcp]
  34. logpath = /var/log/imap4-ssl/current
  35. maxretry = 5
  36. bantime = 864000
  37. findtime = 3600
  38. Filter
  39. # Fail2Ban configuration file
  40. #
  41. # Author: Jackie Craig Sparks
  42. #
  43. # $Revision: 728 $
  44. #
  45. [Definition]
  46. #Looks for failed password logins to SMTP
  47. failregex = ^@\w{1,30} ERR: LOGIN FAILED, ip=.<HOST>.$
  48. ignoreregex =
  49. [edit] Qmail vpopmail imap filter
  50. Jail
  51. [qmail-vpopmail-imap-pw-fail]
  52. enabled = true
  53. filter = qmail-vpopmail-imap-password.conf
  54. action = iptables[name=IMAP, port="143,585,993", protocol=tcp]
  55. logpath = /var/log/imap4/current
  56. maxretry = 5
  57. bantime = 864000
  58. findtime = 3600
  59. Filter
  60. # Fail2Ban configuration file
  61. #
  62. # Author: Jackie Craig Sparks
  63. #
  64. # $Revision: 728 $
  65. #
  66. [Definition]
  67. #Looks for failed password logins to SMTP
  68. failregex = ^@\w{1,30} ERR: LOGIN FAILED, ip=.<HOST>.$
  69. ignoreregex =
  70. [edit] Qmail vpopmail smtp filter
  71. Jail information
  72. [qmail-vpopmail-smtp-pw-fail]
  73. enabled = true
  74. filter = qmail-vpopmail-smtp-password
  75. action = iptables[name=SMTP, port="25,465", protocol=tcp]
  76. logpath = /var/log/maillog
  77. maxretry = 5
  78. bantime = 864000
  79. findtime = 3600
  80. [qmail-vpopmail-smtp-user-notfound]
  81. enabled = true
  82. filter = qmail-vpopmail-smtp-username
  83. action = iptables[name=SMTP, port="25,465" protocol=tcp]
  84. logpath = /var/log/maillog
  85. maxretry = 5
  86. bantime = 864000
  87. findtime = 3600
  88. # Fail2Ban configuration file
  89. #
  90. # Author: Jackie Craig Sparks
  91. #
  92. # $Revision: 728 $
  93. #
  94. [Definition]
  95. # Option: failregex
  96. # Notes.: regex to match the password failures messages in the logfile.
  97. # The host must be matched by a group named "host". The tag "<HOST>" can
  98. # be used for standard IP/hostname matching and is only an alias for
  99. # (?:::f{4,6}:)?(?P<host>\S+)
  100. # Values: TEXT
  101. failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-smtp: vpopmail user not found \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
  102. # Option: ignoreregex
  103. # Notes.: regex to ignore. If this regex matches, the line is ignored.
  104. # Values: TEXT
  105. ignoreregex =
  106. # Fail2Ban configuration file
  107. #
  108. # Author: Jackie Craig Sparks
  109. #
  110. # $Revision: 728 $
  111. #
  112. [Definition]
  113. #Looks for failed password logins to SMTP
  114. failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-smtp: password fail \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
  115. ignoreregex =
  116. [edit] Qmail vpopmail pop3 filter
  117. Heres the jail
  118. [qmail-vpopmail-pop3-user-notfound]
  119. enabled = true
  120. filter = qmail-vpopmail-pop3-username
  121. action = iptables[name=POP3, port="110,995" protocol=tcp]
  122. logpath = /var/log/maillog
  123. maxretry = 5
  124. bantime = 864000
  125. findtime = 3600
  126. Heres the filter
  127. # Fail2Ban configuration file
  128. #
  129. # Author: Jacke Craig Sparks
  130. #
  131. # $Revision: 728 $
  132. #
  133. [Definition]
  134. # Option: failregex
  135. # Notes.: regex to match the password failures messages in the logfile.
  136. # The host must be matched by a group named "host". The tag "<HOST>" can
  137. # be used for standard IP/hostname matching and is only an alias for
  138. # (?:::f{4,6}:)?(?P<host>\S+)
  139. # Values: TEXT
  140. failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-pop3: vpopmail user not found \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
  141.  
  142. # Option: ignoreregex
  143. # Notes.: regex to ignore. If this regex matches, the line is ignored.
  144. # Values: TEXT
  145. ignoreregex =
  146. [qmail-vpopmail-pop3-pw-fail]
  147. enabled = true
  148. filter = qmail-vpopmail-password
  149. action = iptables[name=POP3, port="110,995", protocol=tcp]
  150. logpath = /var/log/maillog
  151. maxretry = 5
  152. bantime = 864000
  153. findtime = 3600
  154.  
  155. # Fail2Ban configuration file
  156. #
  157. # Author: Jackie Craig Sparks
  158. #
  159. # $Revision: 728 $
  160. #
  161.  
  162. [Definition]
  163. #Looks for failed password logins to pop3
  164. failregex = ^\w{3,5} \w{1,2} \w{1,2}:\w{1,2}:\w{1,2} \w{1,6} vpopmail.\d{1,6}.: vchkpw-pop3: password fail \w{1,30}@\w{1,30}-\w{1,30}.\w{1,6}:<HOST>
  165. ignoreregex =
Advertisement
Add Comment
Please, Sign In to add comment