KeyHelp Community

Das offizielle KeyHelp Forum der Keyweb AG / The official KeyHelp forum of Keyweb AG
https://community.keyhelp.de/

Keyhelp und Fail2Ban Config

https://community.keyhelp.de/viewtopic.php?t=13101

Page 1 of 1

Keyhelp und Fail2Ban Config

Posted: Tue 12. Mar 2024, 22:36
by Tobi7889
Moin zusammen,

ich bin aktuell dabei mein System (Debian 12) ein wenig durchzuschauen und dabei ist mir aufgefallen, dass es ein paar Probleme mit Fail2Ban zu geben scheint.
Grundlegend werden SSH IPs massiv gebannt was ja gut ist, auch meine modsecurity Rules greifen korrekt.

Allerdings löst aktuell keine der kh-* Regeln aus.

Spannenderweise gibt es aber diverse Szenarien warum er (in meinen Augen) auslösen sollte:

Code: Select all

pam_unix(proftpd:auth): authentication failure

Code: Select all

warning: unknown[XXX.XXX.XXX.XXX]: SASL LOGIN authentication failed: UGFzc3dvcmQ6, sasl_username=admin@XXXXXXXXXXX

Code: Select all

imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<xxxxxxxxxxx@xxxxxxxxxx.de>, method=PLAIN, rip=xxx.xxx.xxx.xxx, lip=xxx.xxx.xxx.xxx, TLS: Connection closed, session=<tvcnWnsTfdrZ7wPm>
Die Logdateien sind voll von fehlerhaften Logins, auch innerhalb des Zeitraumes, welcher in der keyhelp.local konfiguriert ist.

Ich habe nun einmal eine eigene Datei angelegt mit folgenden Werten:

Code: Select all

[postfix-sasl]
enabled  = true
port     = smtp,ssmtp,smtps,submission,submissions
filter   = postfix-sasl
backend  = systemd
maxretry = 10
findtime = 600
bantime  = 1800  ; 30 Minuten

[postfix-sasl-long]
enabled  = true
port     = smtp,ssmtp,smtps,submission,submissions
filter   = postfix-sasl
backend  = systemd
maxretry = 50
findtime = 3600
bantime  = 86400  ; 1 Tag
Und einen Filter dazu gebaut:

Code: Select all

[Definition]
failregex = warning: unknown\[<HOST>\]: SASL LOGIN authentication failed: .*, sasl_username=.*
Damit wurden direkt diverse IPs ausgesperrt, die mir auch aufgefallen sind.

Meine Frage ist an dieser Stelle, ob die standard postfix.conf im Fail2Ban dieses Szenario nicht abdeckt oder ob es einen Fehler bei mir mit der keyhelp.local gibt? Weil an sich, greift es bei DoveCot und co ja offenbar auch nicht korrekt.

Darin ist eigentlich alles Standard und wie folgt definiert:

Code: Select all

# Mail server

[kh-postfix]
enabled  = true
port     = smtp,ssmtp,smtps,submission,submissions
filter   = postfix
backend  = systemd
maxretry = 6
findtime = 600
bantime = 30m

[kh-dovecot]
enabled  = true
port     = pop3,pop3s,imap,imaps,submission,submissions,sieve
filter   = dovecot
backend  = systemd
maxretry = 10
findtime = 600
bantime = 30m
In meinen Augen müsste es dann ja auch greifen, da ich nicht glaube dass der Standard Filter fehlerhafte Anmeldungen zulässt?

Re: Keyhelp und Fail2Ban Config

Posted: Wed 13. Mar 2024, 08:44
by Alexander
Hallo,

was sagt der Fail2Ban Log, kurz nach dem Neustart von Fail2Ban, wenn er die einzelnen Jails aktiviert.

Re: Keyhelp und Fail2Ban Config

Posted: Wed 13. Mar 2024, 09:22
by Tobi7889
Moin,

Code: Select all

2024-03-13 09:17:59,854 fail2ban.jail           [842246]: INFO    Creating new jail 'postfix-sasl'
2024-03-13 09:17:59,854 fail2ban.jail           [842246]: INFO    Jail 'postfix-sasl' uses systemd {}
2024-03-13 09:17:59,854 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,854 fail2ban.filter         [842246]: INFO      maxRetry: 10
2024-03-13 09:17:59,854 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,854 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,854 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,855 fail2ban.jail           [842246]: INFO    Creating new jail 'sshd-long'
2024-03-13 09:17:59,855 fail2ban.jail           [842246]: INFO    Jail 'sshd-long' uses pyinotify {}
2024-03-13 09:17:59,855 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,856 fail2ban.filter         [842246]: INFO      maxLines: 1
2024-03-13 09:17:59,856 fail2ban.filter         [842246]: INFO      maxRetry: 5
2024-03-13 09:17:59,856 fail2ban.filter         [842246]: INFO      findtime: 86400
2024-03-13 09:17:59,856 fail2ban.actions        [842246]: INFO      banTime: 604800
2024-03-13 09:17:59,856 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,856 fail2ban.jail           [842246]: INFO    Creating new jail 'kh-postfix'
2024-03-13 09:17:59,856 fail2ban.jail           [842246]: INFO    Jail 'kh-postfix' uses systemd {}
2024-03-13 09:17:59,856 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,857 fail2ban.filtersystemd  [842246]: INFO    [kh-postfix] Added journal match for: '_SYSTEMD_UNIT=postfix.service'
2024-03-13 09:17:59,857 fail2ban.filter         [842246]: INFO      maxRetry: 6
2024-03-13 09:17:59,857 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,857 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,857 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,857 fail2ban.jail           [842246]: INFO    Creating new jail 'kh-dovecot'
2024-03-13 09:17:59,857 fail2ban.jail           [842246]: INFO    Jail 'kh-dovecot' uses systemd {}
2024-03-13 09:17:59,876 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,877 fail2ban.datedetector   [842246]: INFO      date pattern `''`: `{^LN-BEG}TAI64N`
2024-03-13 09:17:59,877 fail2ban.filtersystemd  [842246]: INFO    [kh-dovecot] Added journal match for: '_SYSTEMD_UNIT=dovecot.service'
2024-03-13 09:17:59,877 fail2ban.filter         [842246]: INFO      maxRetry: 10
2024-03-13 09:17:59,877 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,877 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,877 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,877 fail2ban.jail           [842246]: INFO    Creating new jail 'kh-ftp'
2024-03-13 09:17:59,877 fail2ban.jail           [842246]: INFO    Jail 'kh-ftp' uses systemd {}
2024-03-13 09:17:59,877 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,878 fail2ban.filtersystemd  [842246]: INFO    [kh-ftp] Added journal match for: '_SYSTEMD_UNIT=proftpd.service'
2024-03-13 09:17:59,878 fail2ban.filter         [842246]: INFO      maxRetry: 6
2024-03-13 09:17:59,878 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,878 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,878 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,878 fail2ban.jail           [842246]: INFO    Creating new jail 'proftpd-passive'
2024-03-13 09:17:59,878 fail2ban.jail           [842246]: INFO    Jail 'proftpd-passive' uses pyinotify {}
2024-03-13 09:17:59,879 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,879 fail2ban.filter         [842246]: INFO      maxRetry: 5
2024-03-13 09:17:59,880 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,880 fail2ban.actions        [842246]: INFO      banTime: 600
2024-03-13 09:17:59,880 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,880 fail2ban.filter         [842246]: INFO    Added logfile: '/var/log/proftpd/proftpd.log' (pos = 0, hash = )
2024-03-13 09:17:59,880 fail2ban.jail           [842246]: INFO    Creating new jail 'kh-phpmyadmin'
2024-03-13 09:17:59,880 fail2ban.jail           [842246]: INFO    Jail 'kh-phpmyadmin' uses systemd {'journalflags': '1'}
2024-03-13 09:17:59,912 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,912 fail2ban.filtersystemd  [842246]: INFO    [kh-phpmyadmin] Added journal match for: 'SYSLOG_IDENTIFIER=phpMyAdmin'
2024-03-13 09:17:59,912 fail2ban.filter         [842246]: INFO      maxRetry: 3
2024-03-13 09:17:59,912 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,912 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,912 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,912 fail2ban.jail           [842246]: INFO    Creating new jail 'kh-roundcube'
2024-03-13 09:17:59,912 fail2ban.jail           [842246]: INFO    Jail 'kh-roundcube' uses systemd {'journalflags': '1'}
2024-03-13 09:17:59,913 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,914 fail2ban.filtersystemd  [842246]: INFO    [kh-roundcube] Added journal match for: 'SYSLOG_IDENTIFIER=roundcube'
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      maxRetry: 5
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,914 fail2ban.actions        [842246]: INFO      banTime: 1800
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,914 fail2ban.jail           [842246]: INFO    Creating new jail 'postfix-sasl-long'
2024-03-13 09:17:59,914 fail2ban.jail           [842246]: INFO    Jail 'postfix-sasl-long' uses systemd {}
2024-03-13 09:17:59,914 fail2ban.jail           [842246]: INFO    Initiated 'systemd' backend
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      maxRetry: 50
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      findtime: 3600
2024-03-13 09:17:59,914 fail2ban.actions        [842246]: INFO      banTime: 86400
2024-03-13 09:17:59,914 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,914 fail2ban.jail           [842246]: INFO    Creating new jail 'test-apache-modsecurity'
2024-03-13 09:17:59,914 fail2ban.jail           [842246]: INFO    Jail 'test-apache-modsecurity' uses pyinotify {}
2024-03-13 09:17:59,915 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,915 fail2ban.filter         [842246]: INFO      maxRetry: 5
2024-03-13 09:17:59,915 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,915 fail2ban.actions        [842246]: INFO      banTime: 600
2024-03-13 09:17:59,915 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,915 fail2ban.filter         [842246]: INFO    Added logfile: '/var/log/apache2/modsec_audit.log' (pos = 34871, hash = 049ddde389ce27efbaaba27b8fea274cb060b8a8)
2024-03-13 09:17:59,915 fail2ban.jail           [842246]: INFO    Creating new jail 'test-apache-modsecurity-long'
2024-03-13 09:17:59,916 fail2ban.jail           [842246]: INFO    Jail 'test-apache-modsecurity-long' uses pyinotify {}
2024-03-13 09:17:59,916 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,916 fail2ban.filter         [842246]: INFO      maxRetry: 20
2024-03-13 09:17:59,916 fail2ban.filter         [842246]: INFO      findtime: 3600
2024-03-13 09:17:59,916 fail2ban.actions        [842246]: INFO      banTime: 3600
2024-03-13 09:17:59,916 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,916 fail2ban.filter         [842246]: INFO    Added logfile: '/var/log/apache2/modsec_audit.log' (pos = 34871, hash = 049ddde389ce27efbaaba27b8fea274cb060b8a8)
2024-03-13 09:17:59,916 fail2ban.jail           [842246]: INFO    Creating new jail 'apache-modsecurity-short'
2024-03-13 09:17:59,916 fail2ban.jail           [842246]: INFO    Jail 'apache-modsecurity-short' uses pyinotify {}
2024-03-13 09:17:59,917 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,918 fail2ban.filter         [842246]: INFO      maxRetry: 15
2024-03-13 09:17:59,918 fail2ban.filter         [842246]: INFO      findtime: 600
2024-03-13 09:17:59,918 fail2ban.actions        [842246]: INFO      banTime: 600
2024-03-13 09:17:59,918 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,918 fail2ban.filter         [842246]: INFO    Added logfile: '/var/log/apache2/modsec_audit.log' (pos = 34871, hash = 049ddde389ce27efbaaba27b8fea274cb060b8a8)
2024-03-13 09:17:59,918 fail2ban.jail           [842246]: INFO    Creating new jail 'apache-modsecurity-long'
2024-03-13 09:17:59,918 fail2ban.jail           [842246]: INFO    Jail 'apache-modsecurity-long' uses pyinotify {}
2024-03-13 09:17:59,918 fail2ban.jail           [842246]: INFO    Initiated 'pyinotify' backend
2024-03-13 09:17:59,919 fail2ban.filter         [842246]: INFO      maxRetry: 30
2024-03-13 09:17:59,919 fail2ban.filter         [842246]: INFO      findtime: 3600
2024-03-13 09:17:59,919 fail2ban.actions        [842246]: INFO      banTime: 3600
2024-03-13 09:17:59,919 fail2ban.filter         [842246]: INFO      encoding: UTF-8
2024-03-13 09:17:59,919 fail2ban.filter         [842246]: INFO    Added logfile: '/var/log/apache2/modsec_audit.log' (pos = 34871, hash = 049ddde389ce27efbaaba27b8fea274cb060b8a8)
2024-03-13 09:17:59,928 fail2ban.jail           [842246]: INFO    Jail 'sshd' started
2024-03-13 09:17:59,929 fail2ban.jail           [842246]: INFO    Jail 'apache-badbots' started
2024-03-13 09:17:59,929 fail2ban.filtersystemd  [842246]: NOTICE  [postfix-sasl] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
2024-03-13 09:17:59,929 fail2ban.jail           [842246]: INFO    Jail 'postfix-sasl' started
2024-03-13 09:17:59,930 fail2ban.jail           [842246]: INFO    Jail 'sshd-long' started
2024-03-13 09:17:59,930 fail2ban.jail           [842246]: INFO    Jail 'kh-postfix' started
2024-03-13 09:17:59,931 fail2ban.jail           [842246]: INFO    Jail 'kh-dovecot' started
2024-03-13 09:17:59,931 fail2ban.jail           [842246]: INFO    Jail 'kh-ftp' started
2024-03-13 09:17:59,932 fail2ban.filtersystemd  [842246]: INFO    [kh-postfix] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,932 fail2ban.jail           [842246]: INFO    Jail 'proftpd-passive' started
2024-03-13 09:17:59,933 fail2ban.jail           [842246]: INFO    Jail 'kh-phpmyadmin' started
2024-03-13 09:17:59,936 fail2ban.jail           [842246]: INFO    Jail 'kh-roundcube' started
2024-03-13 09:17:59,936 fail2ban.filtersystemd  [842246]: NOTICE  [postfix-sasl-long] Jail started without 'journalmatch' set. Jail regexs will be checked against all journal entries, which is not advised for performance reasons.
2024-03-13 09:17:59,937 fail2ban.jail           [842246]: INFO    Jail 'postfix-sasl-long' started
2024-03-13 09:17:59,937 fail2ban.jail           [842246]: INFO    Jail 'test-apache-modsecurity' started
2024-03-13 09:17:59,939 fail2ban.jail           [842246]: INFO    Jail 'test-apache-modsecurity-long' started
2024-03-13 09:17:59,940 fail2ban.jail           [842246]: INFO    Jail 'apache-modsecurity-short' started
2024-03-13 09:17:59,944 fail2ban.jail           [842246]: INFO    Jail 'apache-modsecurity-long' started
2024-03-13 09:17:59,949 fail2ban.filtersystemd  [842246]: INFO    [postfix-sasl] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,951 fail2ban.filtersystemd  [842246]: INFO    [postfix-sasl-long] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,952 fail2ban.filtersystemd  [842246]: INFO    [kh-dovecot] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,953 fail2ban.filtersystemd  [842246]: INFO    [sshd] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,955 fail2ban.filtersystemd  [842246]: INFO    [kh-phpmyadmin] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,955 fail2ban.filtersystemd  [842246]: INFO    [kh-roundcube] Jail is in operation now (process new journal entries)
2024-03-13 09:17:59,978 fail2ban.filtersystemd  [842246]: INFO    [kh-ftp] Jail is in operation now (process new journal entries)

Re: Keyhelp und Fail2Ban Config

Posted: Wed 13. Mar 2024, 16:42
by Ralph
Tobi7889 wrote: ↑Tue 12. Mar 2024, 22:36 Meine Frage ist an dieser Stelle, ob die standard postfix.conf im Fail2Ban dieses Szenario nicht abdeckt oder ob es einen Fehler bei mir mit der keyhelp.local gibt? Weil an sich, greift es bei DoveCot und co ja offenbar auch nicht korrekt.

Code: Select all

[kh-postfix]
mode = aggressive
damit sollte der standard postfix filter strikter greifen - aber es gibt dementsprechend viele false/positive blockings ... der Modus kann zwar noch genauer spezifiziert werden, hat aber auch nicht wirklich gut funktioniert

Ich habe mir daher auch eine extra postfix-sasl.conf und eine postfix-rbl.conf gebaut weil beim Standard Postfix Filter im aggressive mode zu viele false/positives bei meinen Kunden zustande kamen ... den extra sasl filter habe ich momentan auf maxretry = 2 laufen (aufgrund der massiven Attacken) den Standard Postfix Filter auf maxretry = 5 und den extra postfix-rbl Filter auf maxretry = 1

Re: Keyhelp und Fail2Ban Config

Posted: Wed 13. Mar 2024, 19:25
by tab-kh
Also es hilft definitiv

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix.service
durch

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix@-.service
zu ersetzen.

Re: Keyhelp und Fail2Ban Config

Posted: Wed 13. Mar 2024, 19:42
by Ralph
tab-kh wrote: ↑Wed 13. Mar 2024, 19:25 Also es hilft definitiv

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix.service
durch

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix@-.service
zu ersetzen.
ouh, stimmt ... da hab ich ja gar nicht mehr dran gedacht :mrgreen:

Re: Keyhelp und Fail2Ban Config

Posted: Mon 18. Mar 2024, 09:01
by Alexander
tab-kh wrote: ↑Wed 13. Mar 2024, 19:25 Also es hilft definitiv

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix.service
durch

Code: Select all

journalmatch = _SYSTEMD_UNIT=postfix@-.service
zu ersetzen.
Fehler in den Fail2Ban Konfigurationsdateien wie es bei diesem den Anschein hat i.d.R. gern gleich bei den Fail2Ban Entwicklern melden:
https://github.com/fail2ban/fail2ban/issues/


Hat bei einem vergangenen Fall hier im Forum auch gut geklappt:
viewtopic.php?t=12811 -> https://github.com/fail2ban/fail2ban/issues/3622

Re: Keyhelp und Fail2Ban Config

Posted: Fri 14. Feb 2025, 18:20
by Zeitkind
Ich häng mich hier mal an, weil ich das gleiche Problem hab - endlose Loginversuche und fail2ban greift nicht.

meine Lösung:

/etc/fail2ban/filter.d/postfix-sasl-login.conf

Code: Select all

[INCLUDES]
before = common.conf

[Definition]
failregex = ^\s*%(__prefix_line)s\bwarning: \bunknown\[<HOST>\]: SASL LOGIN authentication failed: UGFzc3dvcmQ6\b.*$
ignoreregex =
und

/etc/fail2ban/jail.d/postfix-sasl-login.conf

Code: Select all

[postfix-sasl-login]
enabled  = true
filter   = postfix-sasl-login
action   = iptables[name=POSTFIX, port=smtp, protocol=tcp]
logpath  = /var/log/mail.log
maxretry = 3
findtime = 86400   # 24 hours
bantime  = 604800  # 7 days
Script zum checken was gerade gebannt ist:

Code: Select all

#!/usr/bin/env python3
import subprocess
import re

def get_banned_ips(jail_name):
    # Run fail2ban-client status command
    result = subprocess.run(['fail2ban-client', 'status', jail_name], stdout=subprocess.PIPE, text=True)
    output = result.stdout

    # Extract the banned IPs from the output
    banned_ips = []
    for line in output.splitlines():
        if "Banned IP list:" in line:
            banned_ips = line.split(":")[1].strip().split()
            break

    return banned_ips

def get_whois_info(ip):
    # Run whois command
    result = subprocess.run(['whois', ip], stdout=subprocess.PIPE, text=True)
    whois_output = result.stdout

    # Extract netname and country from whois output
    netname = re.search(r'netname:\s*(.+)', whois_output, re.IGNORECASE)
    country = re.search(r'country:\s*(.+)', whois_output, re.IGNORECASE)

    netname = netname.group(1).strip() if netname else "N/A"
    country = country.group(1).strip() if country else "N/A"

    return netname, country

def main(jail_name):
    banned_ips = get_banned_ips(jail_name)

    for ip in banned_ips:
        netname, country = get_whois_info(ip)
        print(f"{ip}\tRIPE netname:{netname} Country: {country}")

if __name__ == "__main__":
    jail_name = "postfix-sasl-login"  # Replace with your jail name
    main(jail_name)
Wirft zeilenweise die IPs aus mit - soweit möglich - Netz und Land. So was wie:

Code: Select all

fail2ban_whois.py postfix-sasl-login
87.120.93.11	RIPE netname:REYNLOADS-JONATHAN Country: MD
92.118.39.63	RIPE netname:DMZHOST Country: NL
[...]
Ach, und "works for me". Ohne jede Gewährleistung oder Garantie oder Kaffeesahne.
All times are UTC+02:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited