OP is using CSF, no need for fail2ban or firewallD, I thought that was clear. Running fail2ban will create logs saying its already banned because firewallD in disabled. The OP issue is he should not be running fail2ban, maybe mark resolved?
After 62 posts, nothing is clear. I’m not sure that was ‘initial’ condition though I see in post 9 a mention of it for the first time.
Then CFS was missing something that f2b was trying to stop? Interesting.
No idea, he never had CSF monitory the correct log file for a while, so that doesn’t help. It works the same way f2b works, but you can edit number of failed logins over a period of time, so that could be different.
I did a new installation on another server as a test. fail2ban shows the specific problem SASL LOGIN again with the FirewallD enabled. Well, Mr. TZO, there is nothing wrong with my system.
In a google search I saw that others besides me have the same problem.
You do know you can’t have firewallD running and also iptables. You might be best to uninstall CSF id you want firewallD and fail2ban.
You did set up the fail2ban postfix-sasl jail ? Using fail2ban with iptables-allports as the action works fine. Make sure the filter is set to postfix[mode=auth]. Don’t forget you will see entries in the mail log until the jail has had the amount of triggers you have set and the amount of time for fail2ban to check back on, if the time is too short fail2ban will never trigger, but as you are trying to us csf this maybe totally irrelevant
@dimgr You should stop trying to use LFD alongside Fail2Ban! These are similar tools. The actual bug is in the csf/install.generic.sh script, which disables firewalld but doesn’t disable fail2ban.
Long story short—if you use CSF, you shouldn’t use Fail2Ban! Stop making your life more complicated! You don’t need all this micromanagement—who cares who’s trying to brute force your user password? Just set a strong password, and if there is a bug in Postfix, Fail2Ban won’t help you!
I used both csf and fail2ban at the same time because I didn’t know that they do the same job and as you can see in my message I did it in (home for newbiews) because now I’m learning. Now I only have the CSF.
Thanks for the feedback!
Well done!