Resolved Fail2Ban , a little question

[MartinB]

Hello !

I'm using the new 17.5.3'er of Onyx, and found this :

At the fail2ban jails, here are my settings for the " plesk-postfix " jail :

[plesk-postfix]
enabled = true
filter = postfix-sasl
action = iptables-multiport[name="plesk-postfix", port="smtp,smtps,submission"]
logpath = /var/log/maillog
maxretry = 3

Here are some lines from the logfile :

2017-04-01 18:22:20,894 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,034 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,172 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,320 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,456 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,597 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,745 fail2ban.filter [10941]: INFO [plesk-postfix] Found 195.22.126.142
2017-04-01 18:22:21,861 fail2ban.actions [10941]: NOTICE [plesk-postfix] Ban 195.22.126.142

I don't understand, why there more than 3 attempts ?!

Thanks for any help ...


Bye, Martin

 

[WebHostingAce]

All these entries have the "same time". Except for the first one.

All have happened within a second

 

[MartinB]

Oh, I thought fail2ban counts the number of failed attempts of an IP ...
... or are these attempts to fast for a reaction ?

Bye, Martin

 

[WebHostingAce]

As you can see it has taken action with in the same second.

How about allowing it few miliseconds to figure out. Also its not only the maillog its watching

 

[MartinB]

Thanks !




Bye, Martin

 

[WebHostingAce]

Thank you for sharing. Feel more safer with plesk-fail2ban extention now.

Nice to see it has taken action with miliseconds.