我的fail2ban没有像我期望的那样被禁止。
我的日志条目的一个例子是：
Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] Jul 26 07:13:22 mail couriertcpd: LOGIN FAILED, user=ddos, ip=[::ffff:54.193.13.22] Jul 26 07:14:45 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169] 我courierstmp设置更多/etc/fail2ban/filter.d/courierlogin.conf
[INCLUDES] before = common.conf [Definition] _daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)? failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$ ignoreregex =
运行testing没有结果。
fail2ban-regex -v /var/log/mail.log /etc/fail2ban/filter.d/courierlogin.conf Running tests ============= Use failregex file : /etc/fail2ban/filter.d/courierlogin.conf Use log file : /var/log/mail.log Results ======= Failregex: 0 total |- #) [# of hits] regular expression | 1) [0] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?(?:courier|couriertcpd)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?(?:\(\S+\))?[\]\)]?:?|[\[\(]?(?:courier|couriertcpd)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*LOGIN FAILED, user=.*, ip=\[<HOST>\]$ `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [296708] MONTH Day Hour:Minute:Second | [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year | [0] WEEKDAY MONTH Day Hour:Minute:Second Year | [0] WEEKDAY MONTH Day Hour:Minute:Second | [0] Year/Month/Day Hour:Minute:Second | [0] Day/Month/Year Hour:Minute:Second | [0] Day/Month/Year2 Hour:Minute:Second | [0] Day/MONTH/Year:Hour:Minute:Second | [0] Month/Day/Year:Hour:Minute:Second | [0] Year-Month-Day Hour:Minute:Second[,subsecond] | [0] Year-Month-Day Hour:Minute:Second | [0] Year.Month.Day Hour:Minute:Second | [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond] | [0] Day-Month-Year Hour:Minute:Second | [0] Month-Day-Year Hour:Minute:Second[.Millisecond] | [0] TAI64N | [0] Epoch | [0] ISO 8601 | [0] Hour:Minute:Second | [0] <Month/Day/Year@Hour:Minute:Second> | [0] YearMonthDay Hour:Minute:Second | [0] Month-Day-Year Hour:Minute:Second `- Lines: 296708 lines, 0 ignored, 0 matched, 296708 missed
我试图用couriertcpdreplace信使无济于事。 我不知道还有什么可以做到这一点。
经过多次search，我终于意识到提供的filter正则expression式是全民皆有的。 我不需要这个，所以我改变了我的具体情况的正则expression式。
# OLD # failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$ # NEW failregex = couriertcpd: LOGIN FAILED, user=.*, ip=\[<HOST>\]$
这工作，我很高兴地禁止这些害虫。