Dovecot
Fail2Ban 不阻止對 dovecot 的蠻力攻擊
我使用 fail2ban 執行 CentOS 5 伺服器，目前我的 dovecot 服務遭到暴力攻擊。
我知道 fail2ban 正在工作，因為它阻止了對我的 FTP 伺服器和 Postfix 的攻擊。出於某種原因，我錯過了 dovecot 的某些內容，因為 fail2ban 日誌中沒有任何內容，並且攻擊繼續有增無減。
我的日誌如下。Dovecot 將所有內容記錄到 - /var/log/dovecot-info.log
我看到兩種類型的日誌。第一個看起來像這樣（注意：我的伺服器 Ip 沒問題 - 我已經用 xxx.xxx.xxx 屏蔽了更詳細的資訊）：
Feb 22 21:48:21 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:48:23 auth: Info: passwd-file(felipe,177.19.151.139): unknown user Feb 22 21:48:25 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felipe>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:48:29 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:48:31 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:48:40 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:48:42 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:48:50 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:48:52 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:00 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:02 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:11 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:13 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:21 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:23 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:32 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:34 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:42 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:44 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:49:52 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:49:54 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:50:03 auth: Info: passwd-file(felix,177.19.151.139): unknown user Feb 22 21:50:05 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 21:50:13 auth: Info: passwd-file(felix,177.19.151.139): unknown user第二個看起來像這樣：
Feb 22 22:10:37 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<frankie>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:38 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<fox>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<frances>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<francis>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<forest>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<frank>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<forrest>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<frankie>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<fox>, method=PLAIN, rip=177.19.151.139, lip=173.xxx.xxx.xxx Feb 22 22:10:51 auth: Info: passwd-file(francis,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(frances,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(forest,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(frank,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(forrest,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(frankie,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(fox,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(francis,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(frances,177.19.151.139): unknown user Feb 22 22:10:51 auth: Info: passwd-file(forest,177.19.151.139): unknown userjail.conf 看起來像這樣：
[dovecot-pop3imap] enabled = true filter = dovecot-pop3imap action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp] sendmail-whois[name=dovecot-pop3imap, dest=me@me.com, sender=me@me.com] logpath = /var/log/dovecot-info.log maxretry = 5 findtime = 1200 bantime = 1200filter.d/dovecot.conf 看起來像這樣：
failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$ ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to $ ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Ti$ ignoreregex =fail2ban.conf 看起來像這樣：
# Option: loglevel # Notes.: Set the log level output. # 1 = ERROR # 2 = WARN # 3 = INFO # 4 = DEBUG # Values: NUM Default: 3 # loglevel = 3 # Option: logtarget # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. # Only one log target can be specified. # Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log # #logtarget = SYSLOG logtarget = /var/log/fail2ban.log # Option: socket # Notes.: Set the socket file. This is used to communicate with the daemon. Do # not remove this file when Fail2ban runs. It will not be possible to # communicate with the server afterwards. # Values: FILE Default: /var/run/fail2ban/fail2ban.sock # socket = /var/run/fail2ban/fail2ban.sock我幾乎可以肯定我的正則表達式在某種程度上是錯誤的，但我不知所措。在這一點上，任何人都可以提供的任何幫助都是最受歡迎的。
更多資訊 - 我在更改後重新啟動了服務，它沒有區別，日期/時間是準確的。
官方的fail2ban wiki有一些關於如何測試正則表達式的詳細說明。
更具體地說，您應該
fail2ban-regex針對您的日誌（樣本）執行。# fail2ban-regex /var/log/dovecot-info.log /etc/fail2ban/filter.d/dovecot.conf此外，您的配置中似乎存在錯誤：
[dovecot-pop3imap] enabled = true filter = dovecot-pop3imap因為過濾器的名稱應該與文件名匹配
/etc/fai2ban/filters.d我測試了您的日誌樣本，特別是：
Feb 22 21:48:21 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=<felix>, method=PLAIN, rip=177.19.151.139, lip=173.111.111.111第一次嘗試失敗：
# fail2ban-regex sample.log /etc/fail2ban/filter.d/dovecot-pop3imap.conf Running tests ============= No section headers in /etc/fail2ban/filter.d/dovecot-pop3imap.conf在向正則表達式指令添加
[Definition]標記後（為簡潔起見，您不妨省略它），輸出為：# fail2ban-regex sample.log /etc/fail2ban/filter.d/dovecot-pop3imap.conf --print-all-missed Running tests ============= Use failregex file : /etc/fail2ban/filter.d/dovecot-pop3imap.conf Use log file : sample.log Use encoding : UTF-8 Results ======= Failregex: 1 total |- #) [# of hits] regular expression | 1) [1] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?|[\[\(]?\S*(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$ `- Ignoreregex: 0 total Date template hits: |- [# of hits] date format | [1] MON Day 24hour:Minute:Second `- Lines: 1 lines, 0 ignored, 1 matched, 0 missed另請注意，您的正則表達式無法編譯（我沒有嘗試調試原因）。我使用了隨
fail2ban版本一起提供的正則表達式：# rpm -qi fail2ban Name : fail2ban Version : 0.9 Release : 0.3.git1f1a561.fc20這略有不同：
failregex = ^%(__prefix_line)s(pam_unix(\(\S+\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$ ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$