3

I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this:

NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service unavailable; client \[(.*)\] blocked using .* from=<.*>, to=<.*>, proto=ESMTP, helo=<.*>

instead

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 Service unavailable; Client host \[\S+\] blocked using .* from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$

So now it will ban just fine. However, as soon as the ban expires, it will not block it again, but will print in fail2ban.log a lot of "Found" entries, without banning them...

2019-02-13 20:03:50,558 fail2ban.actions        [4924]: NOTICE  [postfix-rbl] 217.169.214.225 already banned
2019-02-13 20:03:50,574 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:50,625 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:50,666 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:50,752 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:50,770 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:50,836 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:50,861 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,132 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,173 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.151.62
2019-02-13 20:03:51,216 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,315 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,410 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,497 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,560 fail2ban.actions        [4924]: NOTICE  [postfix-rbl] 217.169.214.225 already banned
2019-02-13 20:03:51,581 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,604 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.151.62
2019-02-13 20:03:51,751 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.148.30
2019-02-13 20:03:51,860 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:51,961 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,514 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,561 fail2ban.actions        [4924]: NOTICE  [postfix-rbl] 217.169.214.225 already banned
2019-02-13 20:03:52,602 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,689 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,776 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,868 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:52,952 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,141 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,238 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,317 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,325 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,411 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,490 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,563 fail2ban.actions        [4924]: NOTICE  [postfix-rbl] 188.255.152.32 already banned
2019-02-13 20:03:53,577 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,585 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,671 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,707 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,765 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,773 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,854 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.201
2019-02-13 20:03:53,865 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5
2019-02-13 20:03:53,908 fail2ban.filter         [4924]: INFO    [postfix-rbl] Found 188.255.159.5

How do i resolve this? :/ I'm getting really frustrated.

EDIT: Ban action is set in jail.conf for postfix and postfix-rbl like this:

action   = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]

As mentoned, it will ban it just fine at first, as soon as fail2ban starts (or restarts using systemctl restart fail2ban). But not again after it expires.

Improve this question
5
  • Looks to me like the ban action isn't configured to do anything, so the offending host keeps reappearing in the logfile.
    – roaima
    Feb 13, 2019 at 19:37
  • How does it manage to ban those addresses the first time ? At first it will ban them just fine. Maybe you're right, and if so, how do i configure the ban action? Currently i have something like this: " action = %(banaction)s[name=%(name)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] "
    – Marko Todoric
    Feb 14, 2019 at 7:42
  • Do the IP addresses land in a list shown by iptables -nvL? If not they're not actually banned.
    – roaima
    Feb 14, 2019 at 13:55
  • 1
    They do not land the second time. That's the main problem. When i start fail2ban, it will ban IPs just fine. They will show up in iptables - nvL.. After the ban expires, same IPs start flooding the logs, fail2ban says "Found....." but never ends up in iptables - nvL again... Unless i restart fail2ban again.
    – Marko Todoric
    Feb 14, 2019 at 19:21
  • I have the same problem. Sometimes, after fail2ban unbans an address, it will not ban it again, just repeatedly logs Found ${addr}. Restart helps. Version 0.11.2.
    – Edheldil
    Sep 7 at 12:07

1 Answer 1

Reset to default
0

What I think is happening here is that your default ban action is blocking only the target port. The offending host is then hitting other ports and triggering other bans. But because the host is already banned (albeit on other ports) it can't be banned again.

The solution is to change the ban action to block all ports rather then just the offending ones. From memory your action rule would be something like this

action   = %(banaction_allports)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp]
Improve this answer
2
  • Thanks, i will go ahead and try this, see if it works. Thing is, i don't have any other rules and no other ports to ban. Other than postfix and postfix-rbl which uses the same ports, 25, 465, 587. I'll get back with results..
    – Marko Todoric
    Feb 15, 2019 at 11:19
  • 1
    Sorry for delayed response but i havent been able to figure this out. This didn't work. What worked for me is to increase the ban time and lower retry interval. Don't know why tbh...
    – Marko Todoric
    Apr 9, 2019 at 17:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .