We help IT Professionals succeed at work.

Fail2Ban Regex Problem

296 Views
Last Modified: 2018-07-18
Need help with Fail2Ban not catching the "SASL LOGIN authentication failed" in this maillog.  I am running Centos 6.4

Feb 13 09:35:42 ip-172-31-22-236 postfix/smtpd[21234]: warning: unknown[185.222.209.14]: SASL LOGIN authentication failed: authentication failure
Feb 13 09:35:42 ip-172-31-22-236 postfix/smtpd[21234]: disconnect from unknown[185.222.209.14]
Feb 13 09:35:42 ip-172-31-22-236 postfix/smtpd[21237]: warning: unknown[80.211.189.134]: SASL LOGIN authentication failed: authentication failure
Feb 13 09:35:42 ip-172-31-22-236 postfix/smtpd[21237]: disconnect from unknown[80.211.189.134]

Open in new window


Here is the filter for postfix
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = reject: RCPT from (.*)\[<HOST>\]: 554
            reject: RCPT from (.*)\[<HOST>\]: 450 4\.7\.1 : Helo command reject$
failregex = warning: (.*)\[<HOST>\]: SASL LOGIN authentication failed:

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Open in new window


I know this doesn't work because i ran this test.
[root@ip-172-31-22-236 filter.d]# fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/postfix.conf
Use single line: /var/log/mail.log


Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Summary
=======

Sorry, no match

Look at the above section 'Running tests' which could contain important
information.

Open in new window


Thanks,
Comment
Watch Question

nociSoftware Engineer
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Is mail.log containing any records?, does the file exist?
This seems to hint it doesn't

Use single line: /var/log/mail.log

Open in new window


If there are missed (non-matched) lines i would expect something at the bottom of the report like (on one of my systems):

Lines: 72417 lines, 0 ignored, 533 matched, 71884 missed
[processed in 14.32 sec]

Missed line(s): too many to print.  Use --print-all-missed to print all 71884 lines

Open in new window

Author

Commented:
I am not sure I follow your question?  The first entry in this question is a portion of the maillog.  Is that sufficient?
nociSoftware Engineer
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
The output in your fail2ban-regex output seems to tell it could not use this /var/log/mail.log.....
and is using the litteral string.

[root@ip-172-31-22-236 filter.d]# fail2ban-regex /var/log/mail.log /etc/fail2ban/filter.d/postfix.conf

Running tests
=============

Use regex file : /etc/fail2ban/filter.d/postfix.conf
Use single line: /var/log/mail.log


Results
=======

Author

Commented:
Well you both were close it should be maillog instead of mail.log.  Now when I run the test I get this output.

 {removed over a thousand ip's}

Date template hits:
168140 hit(s): MONTH Day Hour:Minute:Second

Success, the total number of match is 28878

Open in new window


Seems to me the regex is too general.  Or am I mistaking?
Software Engineer
CERTIFIED EXPERT
Distinguished Expert 2019
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
This is what came out so looks like it was correct after all


[root@ip-172-31-22-236 ~]# grep "SASL LOGIN authentication failed:" /var/log/maillog | wc -l
29265

Thanks for your help.
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.