similar to: Fail2ban mail failures ???

-----Original Message----- From: ????????? ???????? <nevis2us at infoline.su> Reply-to: CentOS mailing list <centos at centos.org> To: CentOS mailing list <centos at centos.org> Subject: Re: [CentOS] Fail2ban mail failures ??? Date: Fri, 26 Dec 2014 21:30:39 +0300 Robert G. (Doc) Savage ????? 2014-12-26 20:39: > I'm using fail2ban with CentOS 6.6. Something is causing

Received -----Original Message----- From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On Behalf Of centos-request at centos.org Sent: Saturday, December 27, 2014 6:00 AM To: centos at centos.org Subject: CentOS Digest, Vol 119, Issue 26 - Email found in subject Send CentOS mailing list submissions to centos at centos.org To subscribe or unsubscribe via the World Wide

Robert G. (Doc) Savage ????? 2014-12-26 20:39: > I'm using fail2ban with CentOS 6.6. Something is causing fail2ban's > alerts sent to root's mail to be rejected. Here's a clip from one of > the > error messages: > > > Message 48: > From MAILER-DAEMON at lion.protogeek.org Sun Dec 21 03:09:20 2014 > Return-Path:

On 2014-12-26 12:39 pm, Robert G. (Doc) Savage wrote: > I'm using fail2ban with CentOS 6.6. Something is causing fail2ban's > alerts sent to root's mail to be rejected. Here's a clip from one of > the > error messages: > > > Message 48: > From MAILER-DAEMON at lion.protogeek.org Sun Dec 21 03:09:20 2014 > Return-Path:

On Fri, December 26, 2014 12:59, Mike Burger wrote: > On 2014-12-26 12:39 pm, Robert G. (Doc) Savage wrote: >> I'm using fail2ban with CentOS 6.6. Something is causing fail2ban's >> alerts sent to root's mail to be rejected. Here's a clip from one of >> the >> error messages: >> >> >> Message 48: >> From

We're seeing on a few of our servers - and sometimes it's only occasionally on some of those - where fail2ban's running happily, AFAIK, but there's an attack (from China, Brazil, etc) on ssh, and they don't seem to be banned; I see many, many sorries for wrong username or password. It *seems* to work again once restarted. mark

Hello list I'm trying to setup fail2ban specially sasl action but I'm facing problems. I have centos-release-5-9.el5.centos.1 and fail2ban-0.8.7.1-1.el5.rf installed with selinux disabled The errors I get are: INFO Creating new jail 'sasl-iptables' fail2ban.comm : WARNING Invalid command: ['add', 'sasl-iptables', 'polling'] I tried gemin against

Hello list. I have a question for fail2ban for bad logins on sasl. I use sasl, sendmail and cyrus-imapd. In jail.conf I use the following syntax: [sasl-iptables] enabled = true filter = sasl backend = polling action = iptables[name=sasl, port=smtp, protocol=tcp] sendmail-whois[name=sasl, dest=my at email] logpath = /var/log/maillog maxretry = 6 and the following filter:

I've got an up-to-date Centos 5.8 and can't seem to get fail2ban to get rid of troublesome sshd login attempts. /etc/fail2ban/jail.conf has these sections: [ssh] enabled = true port = ssh filter = sshd logpath = /var/log/auth.log maxretry = 6 # Generic filter for pam. Has to be used with action which bans all ports # such as iptables-allports, shorewall [pam-generic] enabled =

On Mon, March 9, 2015 13:11, John Plemons wrote: > Been working on fail2ban, and trying to make it work with plain Jane > install of Centos 7 > > Machine is a HP running 2 Quad core Xeons, 16 gig or ram and 1 plus TB > of disk space. Very generic and vanilla. > > Current available epel repo version is fail2ban-0.9.1 > > Looking at the log file, fail2ban starts and stops

I recall others on this list are using fail2ban to block brute force login attempts. Packages are from the EPEL repo, so I'm just sharing some knowledge here. For about two months now I've had a CentOS 6.3 box (web host) in production that occasionally is ftp brute forced. Oddly enough fail2ban wasn't nabbing the perpetrators. I found that the iptables chain for VSFTP isn't

Hi, I realise that one can simply start fail2ban and then it will insert its own ruleset before shorewall''s ruleset. Are there subscribers to this list having alternative (and probably better) ways to use both fail2ban and shorewall? Thanks, Mark ------------------------------------------------------------------------------ This SF email is sponsosred by: Try Windows Azure free for 90

Hi, To begin I'm sorry for my poor English level, that's not my first language. On CentOS 6 I've installed fail2ban 0.8.4 from EPEL repository. I've configured it with this page : http://centoshelp.org/security/fail2ban/ Then I've tried this command : chkconfig --level 23 fail2ban on && service fail2ban start but the output says it fallen, nothing more. The status

Hello List, with CentOS 7.2 it is not longer possible to run fail2ban on a Server ? I install a new CentOS 7.2 and the EPEL directory yum install fail2ban I don't change anything only I create a jail.local to enable the Filters [sshd] enabled = true .... ..... When I start afterward fail2ban systemctl status fail2ban is clean But systemctl status firewalld is broken ? firewalld.service -

Been working on fail2ban, and trying to make it work with plain Jane install of Centos 7 Machine is a HP running 2 Quad core Xeons, 16 gig or ram and 1 plus TB of disk space. Very generic and vanilla. Current available epel repo version is fail2ban-0.9.1 Looking at the log file, fail2ban starts and stops fine, there isn't output though showing any login attempts being restricted.

I'm trying to setup and test fail2ban with dovecot I've installed fail2ban, I've copied config from https://wiki2.dovecot.org/HowTo/Fail2Ban, and, trying to test it, attempted multiple mail access with wrong password, but, get this: # fail2ban-client status dovecot-pop3imap Status for the jail: dovecot-pop3imap |- Filter | |- Currently failed: 0 | |- Total failed: 0 | `- File

On 13/04/20 1:30 pm, Orion Poplawski wrote: > On 4/9/20 6:31 AM, Andreas Haumer wrote: > ... >> I'm neither a fail2ban nor a SELinux expert, but it seems the >> standard fail2ban SELinux policy as provided by CentOS 7 is not >> sufficient anymore and the recent updates did not correctly >> update the required SELinux policies. >> >> I could report this

Does anyone have the filter strings for Fail2Ban 0.8 to block Dovecot 1.1 login failures? Thanks! Ciao, luigi -- / +--[Luigi Rosa]-- \ If the odds are a million to one against something occurring, chances are 50-50 it will.

I have tried to setup fail2ban on a machine running OpenSuSE 11. Everything looks fine, except the machine restarts the firewall whenever the DHCP lease is renewed, thus flushing all the fail2ban rules (I think.). It seems to me that a quick fix would be to have the system restart fail2ban whenever the firewall is restarted. Has anyone else encountered this issue? .and come up with a solution?

Is anyone using asterisk with fail2ban? I have it working except it takes way more break-in attempts than what is set in "maxretry" in jail.conf For example, I get an email saying: "The IP 199.204.45.19 has just been banned by Fail2Ban after 181 attempts against ASTERISK." when "maxretry = 5" in jail.conf Perhaps someone else is experiencing this or has resolved it,