fail2ban couriertcpd：登錄失敗未禁止

我的fail2ban 沒有像我預期的那樣禁止。

我的日誌條目的一個範例是：-

Jul 26 07:11:29 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169]
Jul 26 07:13:22 mail couriertcpd: LOGIN FAILED, user=ddos, ip=[::ffff:54.193.13.22]
Jul 26 07:14:45 mail couriertcpd: LOGIN FAILED, user=sally, ip=[::ffff:54.191.110.169]

我的 courierstmp 設置更多 /etc/fail2ban/filter.d/courierlogin.conf

[INCLUDES]
before = common.conf
[Definition]
_daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$

ignoreregex = 

執行測試不會產生任何結果。

fail2ban-regex -v  /var/log/mail.log /etc/fail2ban/filter.d/courierlogin.conf 

Running tests
=============

Use   failregex file : /etc/fail2ban/filter.d/courierlogin.conf
Use         log file : /var/log/mail.log


Results
=======

Failregex: 0 total
|-  #) [# of hits] regular expression
|   1) [0] ^\s*(<[^.]+\.[^.]+>)?\s*(?:\S+ )?(?:kernel: \[\d+\.\d+\] )?(?:@vserver_\S+ )?(?:(?:\[\d+\])?:\s+[\[\(]?(?:courier|couriertcpd)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?(?:\(\S+\))?[\]\)]?:?|[\[\(]?(?:courier|couriertcpd)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?(?:\(\S+\))?[\]\)]?:?(?:\[\d+\])?:?)?\s(?:\[ID \d+ \S+\])?\s*LOGIN FAILED, user=.*, ip=\[<HOST>\]$
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [296708] MONTH Day Hour:Minute:Second
|  [0] WEEKDAY MONTH Day Hour:Minute:Second[.subsecond] Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second Year
|  [0] WEEKDAY MONTH Day Hour:Minute:Second
|  [0] Year/Month/Day Hour:Minute:Second
|  [0] Day/Month/Year Hour:Minute:Second
|  [0] Day/Month/Year2 Hour:Minute:Second
|  [0] Day/MONTH/Year:Hour:Minute:Second
|  [0] Month/Day/Year:Hour:Minute:Second
|  [0] Year-Month-Day Hour:Minute:Second[,subsecond]
|  [0] Year-Month-Day Hour:Minute:Second
|  [0] Year.Month.Day Hour:Minute:Second
|  [0] Day-MONTH-Year Hour:Minute:Second[.Millisecond]
|  [0] Day-Month-Year Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second[.Millisecond]
|  [0] TAI64N
|  [0] Epoch
|  [0] ISO 8601
|  [0] Hour:Minute:Second
|  [0] <Month/Day/Year@Hour:Minute:Second>
|  [0] YearMonthDay Hour:Minute:Second
|  [0] Month-Day-Year Hour:Minute:Second
`-

Lines: 296708 lines, 0 ignored, 0 matched, 296708 missed

我曾嘗試用 couriertcpd 替換 courier，但無濟於事。我不確定我還能做些什麼來使它正常工作。

經過大量搜尋，我最終意識到提供的過濾器正則表達式是面向所有人的。我不需要那個，所以我根據我的具體情況更改了正則表達式。

# OLD
# failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[<HOST>\]$
# NEW
failregex = couriertcpd: LOGIN FAILED, user=.*, ip=\[<HOST>\]$

那行得通，我很高興地禁止了這些害蟲。

引用自：https://serverfault.com/questions/710184