• If you are still using CentOS 7.9, it's time to convert to Alma 8 with the free centos2alma tool by Plesk or Plesk Migrator. Please let us know your experiences or concerns in this thread:
    CentOS2Alma discussion
  • Inviting everyone to the UX test of a new security feature in the WP Toolkit
    For WordPress site owners, threats posed by hackers are ever-present. Because of this, we are developing a new security feature for the WP Toolkit. If the topic of WordPress website security is relevant to you, we would be grateful if you could share your experience and help us test the usability of this feature. We invite you to join us for a 1-hour online session via Google Meet. Select a convenient meeting time with our friendly UX staff here.

Question FAIL2BAN filters. Any filter for this intrusion by internet search scanners?

A

alexk345

Basic Pleskian
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connection established
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: master_notify: status 0
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: name_mask: resource
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: name_mask: software
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: connect from scanner-05.ch1.censys-scanner.com[162.142.125.57]
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostname: smtpd_authorized_xforward_hosts: scanner-05.ch1.censys-scanner.com ~? 12>
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostaddr: smtpd_authorized_xforward_hosts: 162.142.125.57 ~? 127.0.0.0/8
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostname: smtpd_authorized_xforward_hosts: scanner-05.ch1.censys-scanner.com ~? [:>
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_hostaddr: smtpd_authorized_xforward_hosts: 162.142.125.57 ~? [::1]/128
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: smtp_stream_setup: maxtime=3600 enable_deadline=0
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: scanner-05.ch1.censys-scanner.com: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: match_list_match: 162.142.125.57: no match
Jan 19 22:49:00 intelligent-mahavira postfix/smtpd[670231]: auto_clnt_open: connected to private/anvil

this is all over my syslog.

i dont see any filters in fail2ban.

How do i write filters?

i wrote a regex to capture all of that ip address

push (@matches,$&) while($search_contents =~ /$regex/gm);

Next is i need to find a way to create filter in fail2ban
 
i am seeing lots of SASL failures in my log files. But postfix-sasl never find any.
So i am testing manually the regex
fail2ban-regex -v /var/log/maillog.processed /etc/fail2ban/filter.d/postfix

This is result i got.
Running tests
=============

Use failregex filter file : postfix, basedir: /etc/fail2ban
Use datepattern : Default Detectors
Use log file : /var/log/maillog.processed
Use encoding : UTF-8


Results
=======

Failregex: 0 total
|- #) [# of hits] regular expression
| 1) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 55[04] 5\.7\.1\s
| 2) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b)
| 3) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b
| 4) [0] ^EHLO from [^[]*\[<HOST>\](?::\d+)?: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b
| 5) [0] ^VRFY from [^[]*\[<HOST>\](?::\d+)?: 550 5\.1\.1\s
| 6) [0] ^RCPT from [^[]*\[<HOST>\](?::\d+)?: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b
| 7) [0] ^from [^[]*\[<HOST>\](?::\d+)?:?
`-

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
| [24457] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}ExYear(?P<_sep>[-/.])Month(?P=_sep)Day(?:T| ?)24hour:Minute:Second(?:[.,]Microseconds)?(?:\s*Zone offset)?
| [0] {^LN-BEG}(?:DAY )?MON Day ExYear %k:Minute:Second(?:\.Microseconds)?
| [0] {^LN-BEG}Day(?P<_sep>[-/])Month(?P=_sep)(?:ExYear|ExYear2) %k:Minute:Second
| [0] {^LN-BEG}Day(?P<_sep>[-/])MON(?P=_sep)ExYear[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
| [0] {^LN-BEG}Month/Day/ExYear:24hour:Minute:Second
| [0] {^LN-BEG}Month-Day-ExYear %k:Minute:Second(?:\.Microseconds)?
| [0] {^LN-BEG}Epoch
| [0] {^LN-BEG}ExYear2ExMonthExDay ?24hour:Minute:Second
| [0] {^LN-BEG}MON Day, ExYear 12hour:Minute:Second AMPM
| [0] {^LN-BEG}ExYearExMonthExDay(?:T| ?)Ex24hourExMinuteExSecond(?:[.,]Microseconds)?(?:\s*Zone offset)?
| [0] {^LN-BEG}(?:Zone name )?(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}(?:Zone offset )?(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
| [0] {^LN-BEG}TAI64N
| [0] {^LN-BEG}24hour:Minute:Second
| [0] ^<Month/Day/ExYear2@24hour:Minute:Second>
| [0] ^MON-Day-ExYear2 %k:Minute:Second
`-

Lines: 24457 lines, 0 ignored, 0 matched, 24457 missed
[processed in 1.59 sec]

========================================================= END=======================================
Click to expand...


This is sample of maillog.processed


Jan 18 16:06:47 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=15)
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:47 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:49 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=9)
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:50 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=8)
Jan 18 16:06:50 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=11)
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:51 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:52 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=10)
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:52 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=8)
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:53 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=11)
Jan 18 16:06:53 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: lost connection after AUTH from unknown[193.169.255.111]
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: disconnect from unknown[193.169.255.111] ehlo=1 auth=0/1 commands=1/2
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: connect from unknown[193.169.255.111]
Jan 18 16:06:54 intelligent-mahavira plesk_saslauthd[628869]: failed mail authentication attempt for user 'administrator' (password len=13)
Jan 18 16:06:54 intelligent-mahavira postfix/smtpd[628887]: warning: unknown[193.169.255.111]: SASL LOGIN authentication failed: authentication failure
Click to expand...
 
You must log in or register to reply here.

Similar threads

P
Issue fail2ban postfix.conf not filtering authentication failures (dictionary attacks)
Replies
0
Views
3K
PeterKi
P
P
Resolved fail2ban postfix-sasl not working correctly
Replies
7
Views
10K
Alaa Mansour
Alaa Mansour
israel diaz
Question it is normal in the syslog
Replies
3
Views
1K
israel diaz
israel diaz
WebHostingAce
Question Block MJ12bot with Plesk Fail2Ban plesk-apache-badbot Filter
Replies
7
Views
12K
danami
danami
R
Fail2ban setting findtime per Jail
Replies
13
Views
4K
trialotto
T
Back
Top