Fail2ban is merely an added layer of protection. Misconfiguring it doesn’t make you “vulnerable to attacks”, as long as your services are up to date and your passwords are solid. Obviously, it’s nice to have layers of protection. But, it’s not a reason to panic if fail2ban is acting weird for a bit.
I’m seeing a lot of people trying to change the subject in this thread. This thread is 61 comments long; please don’t make it even longer by introducing a bunch of new stuff to talk about.
At this point, I have no idea what the problem is or the current state of it.
Still…?
It’s not about fail2ban strange behavior but about several IPs that have hacked the server and have been sending spam emails for several days now.
Even that is not clear yet…?
why did post 1 say this then ?
Sorry but I don’t follow you…
This was an introduction to the problem, then since you said it wasn’t something to worry about, I detailed the problem.
I’m not telling you to not fix the problem.
I’m telling folks in this thread to calm down and focus on the specific issue. But, also, this thread is so long and chaotic, I’m confused about what problem we’re trying to solve.
2 Likes
Hi, what time zone you’re? I’m UK, I would like to have look with you on this one. I’m also pure Debian and write my own f2b rules and changed those which did not work since Debian 9. If you want we can do Google meeting call where you and I can share screen if you want. I would like to see also firewall etc. I wouldn’t try to post any regex here as it might be too complex for understanding but speaking in person can accomplish simplicity and time saving. Let me know, however I am free only weekends. I wouldn’t be too upset 66 times replied and still not solved means a bit wasted time. Let’s sort the issue.
Me too, but I don’t think I made a mistake, there was a discrepancy between those who tried to help me, I’m just trying to follow what is ‘implied’ to me…
That would be perfect, so I’m sure we’ll be able to fix it in 10 minutes…
But do you happen to have Skype so I already have it installed…?
That’s why I said to ban those IP’s directly. Then everything calms down and makes working on the root cause easier.
Everything is more clear when you aren’t putting out a raging fire.
I’m doing this every day, but we’re talking about tens, hundreds of IPs a day. Do you think it’s normal to do it manually?
I have set the limit to 10 mails per day, on the whole server, but they continue to send hundreds, thousands of spam mails per day.
What does fail2ban have to do with spam? Fail2ban can’t really solve spam…spammers are not authenticating to your mail server because they are sending mail to users on your sererv, thus there will never be auth failures for fail2ban to block on.
Spam is (generally) addressed by SpamAssassin, optionally greylisting, and maybe some other policies you might choose to implement.
To be clear, I’m saying if you want to talk about stopping spam, start a new topic, because this aint it. This is about fail2ban, and has basically nothing to do with stopping incoming spam.
More than anything, it seems to me that there are problems of understanding here…
Spam is not incoming but outgoing!
Outgoing needs authentication on the server (else some script has been put on the server) also you should see a queue as you would get alot of rejects.
Outgoing spam has even less to do with fail2ban.
If the sender of the spam is local (i.e. an exploited web application or a compromised user, or a legitimate user doing illegitimate things), they do not authenticate and fail2ban rules can never apply to them.
If the sender of the spam is remote, their authentication is succeeding and would never be blocked by fail2ban (I know the authentication has to be succeeding, because in a default Virtualmin configuration, Postfix would not be configured as an open relay).
So…outgoing spam is not going to be solved or even mitigated by fail2ban. You’re focusing on something wholly irrelevant to the problem of outgoing spam.
1 Like
Indeed yes, a queue is created in Postfix… And from there I realize that they are spamming, so I manually ban with Fail2ban, filtering the IPs from the mail.log
So is there a configuration problem in Postfix…? Show me the way to go
First of all. Use pflogsumm to identify the address or addresses that send the most mail. It is likely that spammers address will be among them. This is a start. And then the long distance running begins 
.
1 Like