Resolved Fail2ban plesk-dovecot does not ban bad logins

[Deleted member 259837]

Server operating system version

Debian 12.12 x86_64

Plesk version and microupdate number

18.0.73.2 #2

Fail2ban does not catch bad logins anymore. For example over hours attacker try to login with non-existing mail-users.

Product version: Plesk Obsidian 18.0.73.2
OS version: Debian 12.12 x86_64
Build date: 2025/10/03 15:00
Revision: 697b1ead827b8f34242d318faa04cd8e803398a3

As failban dovecot filter has very complex regex i am not able to debug any faults in filter.
/var/log/fail2ban.log has no entries for bans with [plesk-dovecot].

Filter:

# Fail2Ban filter Dovecot authentication and pop3/imap server
#
# Based on filter dovecot.conf from fail2ban-1.0.2

[INCLUDES]

before = common.conf

[Definition]

_daemon = (?:dovecot(?:-auth)?|auth)

_auth_worker = (?:dovecot: )?auth(?:-worker)?
_auth_worker_info = (?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*

prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$

failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
            ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\):(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
            ^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
            ^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
            <mdre-<mode>>

mdre-aggressive = ^(?:Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,)(?: (?:in|waited) \d+ secs)?\):(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$

mdre-normal =

# Parameter `mode` - `normal` or `aggressive`.
# Aggressive mode can be used to match log-entries like:
#   'no auth attempts', 'disconnected before auth was ready', 'client didn't finish SASL auth'.
# Note it may produce lots of false positives on misconfigured MTAs.
# Ex.:
# filter = dovecot[mode=aggressive]
mode = normal

ignoreregex =

journalmatch = _SYSTEMD_UNIT=dovecot.service

datepattern = {^LN-BEG}TAI64N
              {^LN-BEG}

# DEV Notes:
# * the first regex is essentially a copy of pam-generic.conf
# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
#
# Author: Martin Waschbuesch
#         Daniel Black (rewrote with begin and end anchors)
#         Martin O'Neal (added LDAP authentication failure regex)
#         Sergey G. Brester aka sebres (reviewed, optimized, IPv6-compatibility)

I am grateful for any support.

 

[Deleted member 259837]

fail2ban-client status plesk-dovecot
Status for the jail: plesk-dovecot
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/maillog
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

 

[danami]

This is because dovecot 2.4 logs to a different format that doesn't match the old filter. As a temp fix you can replace the old filter with the latest dovecot filter from the fail2ban github repo. I've tested the new dovecot filter it and it works with dovecot 2.4:

https://raw.githubusercontent.com/fail2ban/fail2ban/refs/heads/master/config/filter.d/dovecot.conf

 

[Deleted member 259837]

Problem solved with the newest filter from fail2ban repo.

Thanks a lot.