Then configure fail2ban to use the new action, in /etc/fail2ban/jail.local and /etc/fail2ban/jail.d/zimbra.local change Unreachable and prohibit correspond to the ICMP reject messages. # Note: Type can be blackhole, unreachable and prohibit. Next replace the local ip route command with an SSH command to run remotely, from this: This article is not meant to cover all possible scenarios, but to get you started here is a basic example:Ĭreate a new action by copying the default route action:Ĭp /etc/fail2ban/action.d/nf /etc/fail2ban/action.d/nf And set up SSH public key authentication so the server where you run fail2ban can connect to the server where the ban action needs to be applied. To do this you would need to create a custom fail2ban action. In addition you may want to use a centralized logging server and if you decide to ban a bad actor, deny access to all servers in your environment. This can be a problem if you run Zimbra in a multi server scenario, where you can read the logs on the mailbox server, but want to apply the ban on the proxy server.
So it does it’s ban actions on the same server where it reads the logs. Zmprov mcf +zimbraMailTrustedIP 127.0.0.1 +zimbraMailTrustedIP ')įail2ban works by parsing log files using regular expressions, you can test the regular expression by using fail2ban-regex like this:įail2ban-regex /opt/zimbra/log/mailbox.log /etc/fail2ban/filter.d/nf Multi server and centralized syslogįail2ban is designed to work on the local server. If you are running nginx on the same node as the mailstore, you will need to add both 127.0.0.1 and the real IP address of that node: It is required the OIP configuration must be done before configuring Fail2Ban service. This article has been validated using a set-up installed using which you can use to test fail2ban before applying to your production environment. If you use ufw or firewalld you may see errors when trying to ban/unban such as ERROR Failed to execute ban jail … action 'route'. Especially brute force attacks on SMTP are very common.įail2ban has been tested in combination with netfilter-persistent and iptables. This can help mitigate brute force attacks on Zimbra. This article is a how-to guide on installing Fail2Ban to block attacking hosts using a null route or blackhole routes. This article is a Work in Progress, and may be unfinished or missing sections.
0 kommentar(er)
