Topic: Fail2Ban does not create firewall rules for Roundcube
==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release): 1.6.2 MARIADB edition
- Deployed with downloadable installer
- Linux/BSD distribution name and version: Ubuntu 22.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx):Nginx
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hi,
I've faced the issue with Fail2ban does not create firewall rules for Roundcube
It works fien with ssh blocks, thow.
i've tried with default nftables and ufw
here is the result for nftables:
jail.local:
[DEFAULT]
# time is in seconds. 3600 = 1 hour, 86400 = 24 hours (1 day)
findtime = 3600
bantime = 3600
maxretry = 5
ignoreip = 127.0.0.1 78.107.248.18 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16jail.d/roundcube.local
[roundcube]
backend = polling
journalmatch=
enabled = true
findtime = 3600
filter = roundcube.iredmail
logpath = /var/log/mail.log
action = nftables-multiport[name=roundcube, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]
banned_db[name=roundcube, port="80,443,25,587,465,110,995,143,993,4190", protocol=tcp]With config f2b detects failure attempts, and execute the action but no FW rules are actully added. For testing purpuses i'm entering wrong pass on Webmail page
#fail2ban-client status roundcube
Status for the jail: roundcube
|- Filter
| |- Currently failed: 2
| |- Total failed: 155
| `- File list: /var/log/mail.log
`- Actions
|- Currently banned: 1
|- Total banned: 10
`- Banned IP list: 212.xx.xx.xxSSH filter works in the mean time
# nft list ruleset
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
iif "lo" accept
ip protocol icmp icmp type echo-request limit rate over 10/second burst 4 packets drop
ip6 nexthdr ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 4 packets drop
ct state established,related accept
ip6 nexthdr ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, mld-listener-query, mld-listener-report, mld-listener-done, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } accept
ip protocol icmp icmp type { destination-unreachable, echo-request, router-advertisement, router-solicitation, time-exceeded, parameter-problem } accept
ip protocol igmp accept
tcp dport 22 accept
tcp dport 80 accept
tcp dport 443 accept
tcp dport 25 accept
tcp dport 587 accept
tcp dport 465 accept
tcp dport 110 accept
tcp dport 995 accept
tcp dport 143 accept
tcp dport 993 accept
counter packets 1159 bytes 54966 drop
}
chain output {
type filter hook output priority filter; policy accept;
}
chain forward {
type filter hook forward priority filter; policy drop;
}
}
table ip filter {
}
table inet f2b-table {
set addr-set-sshd {
type ipv4_addr
elements = { 27.150.190.96, 103.172.120.13,
149.202.74.37, 179.60.147.101 }
}
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
tcp dport 22 ip saddr @addr-set-sshd reject with icmp port-unreachable
}
}UFW config
jail.local is the same as above
jail.d/roundcube.local
[roundcube]
backend = polling
journalmatch=
enabled = true
findtime = 3600
filter = roundcube.iredmail
logpath = /var/log/mail.log
banaction = ufw
port = 80,443,25,587,465,110,995,143,993,4190ufw status
Status: active
To Action From
-- ------ ----
Anywhere REJECT 212.xxx.xxx.xxx
OpenSSH DENY 141.94.110.90
OpenSSH DENY 122.195.71.170
22/tcp ALLOW Anywhere
Postfix ALLOW Anywhere
Nginx Full ALLOW Anywhere
Postfix Submission ALLOW Anywhere
Postfix SMTPS ALLOW Anywherethe result is: upper line is added: Anywhere REJECT 212.xxx.xxx.xxx
1st issue here is that before current session is finished ufw does not block inboud connection. Meanes i can keep accessing Webmail page(endlessly enterring wrong pass) untill i stop and session is terminated by timeout.
2nd issue - source is Anywhere but not particular port
What can i do to fix this?
I'd prefere to stay with UFW if possible, but if the sullution works only with nftables i'll survive with that too.
Thanks in davance for you help
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.
