my email+webmail+fail2ban server inside in LAN and for LAN users fail2ban work ok
i config reverseproxy for access external users to my server roundcube.
and fal2ban not block IP address external users and not show status ‘Banned IP’
i see
/var/log/roundcubemail/errors.log
and see next entries, for example
[26-Sep-2018 20:08:15 +0500]: IMAP Error: Login failed for ib from 192.168.XXX.XXX(X-Forwarded-For: XXX.XXX.XXX.XXX). AUTHENTICATE PLAIN: Password: in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 197 (POST /webmail/?_task=login?_task=login&_action=login)
i see ip address 192.168.XXX.XXX - its IP my NS7(gateway,proxy, ReverseProxy etc) internal LAN
and see X-Forwarded-For: XXX.XXX.XXX.XXX its real users external IP
i think fail2ban not matched if see X-Forwarded-For: XXX.XXX.XXX.XXX
if entries look like
[26-Sep-2018 18:52:26 +0500]: IMAP Error: Login failed for ib from 192.168.XXX.XXX. AUTHENTICATE PLAIN: Password: in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 197 (POST /webmail/?_task=login?_task=login&_action=login)
without string X-Forwarded-For
it work and fail2ban work ok
we could not cover all corner cases done by custom customization, at least now. That’s said this is right for all web applications you have on your server (phpmyadmin, sogo, …)
you could make a filter.local
/etc/fail2ban/filter.d/roundcube-auth.local
copy all the regex and add one more…not tested you should adapt it
^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from * (X-Forwarded-For: <HOST>)(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
before = common.conf
[Definition]
failregex = ^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
^\[\]:\s*(<[\w]+>)? Failed login for [\w\-\.\+]+(@[\w\-\.\+]+\.[a-zA-Z]{2,6})? from <HOST> in session \w+( \(error: \d\))?$
^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from * (X-Forwarded-For: <HOST>)(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
ignoreregex =
test it
fail2ban-regex /var/log/roundcubemail/errors.log /etc/fail2ban/filter.d/roundcube-auth.local
Running tests
=============
Use failregex filter file : roundcube-auth, basedir: /etc/fail2ban
Use log file : /var/log/roundcubemail/errors.log
Use encoding : UTF-8
Results
=======
Failregex: 70 total
|- #) [# of hits] regular expression
| 1) [70] ^\s*(\[\])?(\S+\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
`-
Ignoreregex: 0 total
Date template hits:
|- [# of hits] date format
| [112] Day(?P<_sep>[-/])MON(?P=_sep)Year[ :]?24hour:Minute:Second(?:\.Microseconds)?(?: Zone offset)?
`-
Lines: 112 lines, 0 ignored, 70 matched, 42 missed
[processed in 0.02 sec]
Missed line(s): too many to print. Use --print-all-missed to print all 42 lines
‘X-Forwarded-For’ missed [28-Sep-2018 11:29:58 +0500]: <bvdem97f> IMAP Error: Login failed for ib from 192.168.XX.XX(X-Forwarded-For: XXX.XXX.XXX.XXX). AUTHENTICATE PLAIN: Password: in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 197 (POST /webmail/?_task=login?_task=login&_action=login)
may be i some thing wrong do?
matched if like look [28-Sep-2018 11:25:06 +0500]: <ta0bma91> IMAP Error: Login failed for ib from 192.168.XX.XX. AUTHENTICATE PLAIN: Password: in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 197 (POST /webmail/?_task=login?_task=login&_action=login)
missed if like look [28-Sep-2018 11:29:58 +0500]: <bvdem97f> IMAP Error: Login failed for ib from 192.168.XX.XX(X-Forwarded-For: XXX.XXX.XXX.XXX). AUTHENTICATE PLAIN: Password: in /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 197 (POST /webmail/?_task=login?_task=login&_action=login)
or do you want me to put all the lines here? matched and missed
they are identical
Hi!
i think, you don understand me.
create errors.log file and put two string
[28-Sep-2018 11:25:06 +0500]: <ta0bma91> IMAP Error: Login
failed for ib from 192.168.XX.XX. AUTHENTICATE PLAIN: Password: in
/usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line
197 (POST /webmail/?_task=login?_task=login&_action=login)
and
[28-Sep-2018 11:29:58 +0500]: <bvdem97f> IMAP Error: Login
failed for ib from 192.168.XX.XX(X-Forwarded-For: XXX.XXX.XXX.XXX).
AUTHENTICATE PLAIN: Password: in
/usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line
197 (POST /webmail/?_task=login?_task=login&_action=login)
create roundcube-auth.local with your changes.
and test it
fail2ban-regex errors.log roundcube-auth.local
you are see 1 matched and 1 missed
but should be 2 matched.
failregex = ^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
^\[\]:\s*(<[\w]+>)? Failed login for [\w\-\.\+]+(@[\w\-\.\+]+\.[a-zA-Z]{2,6})? from <HOST> in session \w+( \(error: \d\))?$
^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from .*\(X-Forwarded-For: <HOST>\)(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
restart fail2ban
systemctl restart fail2ban
this change will be overwritten by the next fail2ban update
