Facebook
TwitterUsername:
TITLE
Postfix fail2ban filter misses authentication failures
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
AlmaLinux 9.8 (Olive Jaguar), Plesk Obsidian 18.0.79 Update #3
PROBLEM DESCRIPTION
The default postfix fail2ban filter misses authentication failures.
STEPS TO REPRODUCE
Enable fail2ban and the postfix jail and note that no IP addresses appear in the jail despite multiple lines in the pattern:
Jul 22 20:48:38 mail postfix/smtpd[1342054]: warning: unknown[109.248.156.49]: SASL LOGIN authentication failed: authentication failure, sasl_username=steve
ACTUAL RESULT
No IP addresses ever appear in the postfix jail
EXPECTED RESULT
IPs collect in the jail
ANY ADDITIONAL INFORMATION
The mdre-auth pattern is
^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: (?! Connection lost to authentication server| Invalid authentication mechanism)
(space added to "authentication failed: (?!" to stop unhappy face!)
Although strangely the mdre-auth2 pattern mimics the above, only omitting negative lookahead of not matching on lines including 'Connection lost to authentication server' or 'Invalid authentication mechanism'
On a sample log line of:
Jul 22 20:48:38 mail postfix/smtpd[1342054]: warning: unknown[109.248.156.49]: SASL LOGIN authentication failed: authentication failure, sasl_username=steve
the mdre-auth pattern...
How to Fix It
To make this log line match successfully in Fail2ban, you need to account for the PID brackets by changing the prefix. Modify the beginning of your regex to allow brackets before the host IP:
I have worked around this by defining an override rule. Full description of what I've configured is included in my post Resolved - Preventing bot brute force probes against Postfix/SMTP
I think it worth checking the match patterns and checking whether I am correct or have gone off on a tangent. I also question why authentication errors are omitted from the default configured filter. Should mdpr-extra (mdpr-normal + mdpr-auth) not be the default filter, else you leave a machine open to endless SMTP auth probes?
Thanks for the great job you do with Plesk
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug
TITLE
Postfix fail2ban filter misses authentication failures
PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
AlmaLinux 9.8 (Olive Jaguar), Plesk Obsidian 18.0.79 Update #3
PROBLEM DESCRIPTION
The default postfix fail2ban filter misses authentication failures.
STEPS TO REPRODUCE
Enable fail2ban and the postfix jail and note that no IP addresses appear in the jail despite multiple lines in the pattern:
Jul 22 20:48:38 mail postfix/smtpd[1342054]: warning: unknown[109.248.156.49]: SASL LOGIN authentication failed: authentication failure, sasl_username=steve
ACTUAL RESULT
No IP addresses ever appear in the postfix jail
EXPECTED RESULT
IPs collect in the jail
ANY ADDITIONAL INFORMATION
The mdre-auth pattern is
^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: (?! Connection lost to authentication server| Invalid authentication mechanism)
(space added to "authentication failed: (?!" to stop unhappy face!)
Although strangely the mdre-auth2 pattern mimics the above, only omitting negative lookahead of not matching on lines including 'Connection lost to authentication server' or 'Invalid authentication mechanism'
On a sample log line of:
Jul 22 20:48:38 mail postfix/smtpd[1342054]: warning: unknown[109.248.156.49]: SASL LOGIN authentication failed: authentication failure, sasl_username=steve
the mdre-auth pattern...
- The First Bracket Trap: The pattern ^[^[]* tells the engine to start at the beginning of the line and match any character except an opening bracket [.
- Premature Stop: It scans the text and is forced to stop early at the process ID bracket: postfix/smtpd[1342054]:.
- Mismatched Host: The regex then immediately expects the <HOST> (IP address) inside that first set of brackets. Instead, it finds the process ID (1342054), causing the match to fail completely.
How to Fix It
To make this log line match successfully in Fail2ban, you need to account for the PID brackets by changing the prefix. Modify the beginning of your regex to allow brackets before the host IP:
- Change from: ^[^[]*\[<HOST>\]
- Change to: ^[^:]*:\s*(?:warning:\s*)?(?:unknown)?\[<HOST>\]
I have worked around this by defining an override rule. Full description of what I've configured is included in my post Resolved - Preventing bot brute force probes against Postfix/SMTP
I think it worth checking the match patterns and checking whether I am correct or have gone off on a tangent. I also question why authentication errors are omitted from the default configured filter. Should mdpr-extra (mdpr-normal + mdpr-auth) not be the default filter, else you leave a machine open to endless SMTP auth probes?
Thanks for the great job you do with Plesk
YOUR EXPECTATIONS FROM PLESK SERVICE TEAM
Confirm bug