Recent content by iainh

Hardening Dovecot A further thought on this topic of banning bad bots, is that you can do similar to tighten up Dovecot, presuming you are using Dovecot for IMAP and POP3 services. In the Plesk panel/UI, navigate to Home > Tools & Settings > IP Address Banning > Jails > plesk-dovecot and click...

Username: TITLE Postfix fail2ban filter misses authentication failures PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE AlmaLinux 9.8 (Olive Jaguar), Plesk Obsidian 18.0.79 Update #3 PROBLEM DESCRIPTION The default postfix fail2ban filter misses authentication failures. STEPS TO REPRODUCE...

And another observation for those interested in seeing this all working: fail2ban-client status plesk-postfix is showing me a list ending 168.253.224.242 211.216.58.204. But tailing maillog for "authentication failed:" shows the last entries as: Jul 22 21:01:34 mail postfix/smtpd[1345648]...

An interesting observation on the auth attempts still being made: Jul 22 21:01:23 mail postfix/smtpd[1345648]: warning: dsl-hkibng42-50dfc9-173.dhcp.inet.fi[80.223.201.173]: SASL LOGIN authentication failed: authentication failure, [email protected] Jul 22 21:01:34 mail...

In my initial post: The use of ‘mdre-auth3’ is that the mail filer contains definitions... Should read: The use of ‘mdre-auth3’ is that the jail filter contains definitions...

Right, to the final part ... and maybe the editor will play more nicely now?? We now have authentication attempts against port 25 blocked, fail2ban now recognising auth failures being recorded in maillog and blocking bad actors. The plesk-postfix jail is now actually working :) Our last task...

Before we start... I am posting this more as advice to others. It could be considered in tandem with my post 'Plesk firewall and preventing clashes with firewalld' and generally hardening a Plesk server. This firewallld post is important IMHO as I found admin services with access locked-down...

Okay, so for anyone else wandering into this post with the same issue of firewallld and Plesk firewalls running together, these are the precise steps I took to safely disable firewallld and (so far :oops:) not lock myself out of my server. The steps are detailed as a pet hate is people that...

I think the issue @manos is referring to is that someone's access to the server may be dependent on firewalld configured rules. As disabling firewalld also results in the removal of rules it has added, disabling could result in someone removing rules on which their own access relies. I have...

Yes, I'm using AlmaLinux 9.8 (Olive Jaguar) (mentioned in post header) Yes, I should have (would retest) VNS console access should things go south before I go changing too many things I presume the reference to "ssh dhcp and cokpit" by @manos is a block of all access other than (presumably)...

I have my Plesk firewall set to only permit privileged service access only from my own IP (using the "Allow from selected sources, deny from others" rule option and listing my IP). This applies to the rules for "Plesk administrative interface" (and HTTP/3 equivalent) which I take to mean port...

I'm seeing this as well, one IP from a hosting provider known for bad actors, trying over and over: [Action Log] Failed login attempt with login 'root' from IP x.x.x.x My query is becasue... Yes, Fail2Ban and the plesk-panel jail are enabled, but it's low rate but endless More importantly, in...

Thanks for your help and advice @Bitpalast

dnf update run and looking better now: # dnf update Last metadata expiration check: 2:17:08 ago on Fri 08 May 2026 18:17:10 BST. Dependencies resolved. Nothing to do. Complete!

Perfect. Thank you again. I have done this, just not applied the (test) kernal patch. I see I'm back on kernel-5.14.0-611.54.3.el9_7 (for AlmaLinux 9), so maybe I need to look into doing a more comprehensive update via sudo dnf update