external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2024-12-26 07:57:05 +00:00
Code Issues Releases Wiki Activity
ea452d5441
mailinabox/conf/fail2ban/jails.conf

101 lines
2.4 KiB
Plaintext
Raw Normal View History

add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
# Fail2Ban configuration file for Mail-in-a-Box. Do not edit.
# This file is re-generated on updates.
Cleanup blank lines, comments and whitespace to make it easier to follow
2015-07-02 09:19:37 +00:00
fail2ban: whitelist our machine's public ip address so status checks dont cause bans of the machine itself
2015-12-07 13:45:59 +00:00
[DEFAULT]
# Whitelist our own IP addresses. 127.0.0.1/8 is the default. But our status checks
# ping services over the public interface so we should whitelist that address of
# ours too. The string is substituted during installation.
add ipv6 localhost to ignore ip list
2021-07-04 18:09:07 +00:00
ignoreip = 127.0.0.1/8 ::1/128 PUBLIC_IP PUBLIC_IPV6 ADMIN_HOME_IP ADMIN_HOME_IPV6
Add own changes
2021-04-11 10:14:41 +00:00
bantime = 15m
findtime = 120m
maxretry = 4
fail2ban: whitelist our machine's public ip address so status checks dont cause bans of the machine itself
2015-12-07 13:45:59 +00:00
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[dovecot]
enabled = true
filter = dovecotimap
logpath = /var/log/mail.log
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 2m
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
maxretry = 20
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319
2015-03-08 00:13:55 +00:00
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[miab-management]
enabled = true
filter = miab-management-daemon
port = http,https
logpath = /var/log/syslog
maxretry = 20
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 15m
Added more bantime and lowered max retry attempts Ban time was too low for preventing ssh brute force attacks, this change also allows to keep the auth.log more clean and avoid wasting cpu and i/o on this. Bots eventually will flag your IP as secure and move along.
2015-07-02 15:55:43 +00:00
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[miab-munin]
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319
2015-03-08 00:13:55 +00:00
enabled = true
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
port = http,https
filter = miab-munin
logpath = /var/log/nginx/access.log
maxretry = 20
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 15m
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319
2015-03-08 00:13:55 +00:00
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[miab-owncloud]
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319
2015-03-08 00:13:55 +00:00
enabled = true
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
port = http,https
filter = miab-owncloud
Move from ownCloud to Nextcloud
2017-03-25 12:20:21 +00:00
logpath = STORAGE_ROOT/owncloud/nextcloud.log
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
maxretry = 20
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 15m
Configure fail2ban jails to prevent dumb brute-force attacks against postfix, dovecot and ssh. See #319
2015-03-08 00:13:55 +00:00
Enable and recommend port 465 for mail submission instead of port 587 (fixes #1849) Port 465 with "implicit" (i.e. always-on) TLS is a more secure approach than port 587 with explicit (i.e. optional and only on with STARTTLS). Although we reject credentials on port 587 without STARTTLS, by that point credentials have already been sent.
2021-05-09 14:11:40 +00:00
[miab-postfix465]
enabled = true
port = 465
filter = miab-postfix-submission
logpath = /var/log/mail.log
maxretry = 20
findtime = 30
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[miab-postfix587]
enabled = true
port = 587
filter = miab-postfix-submission
logpath = /var/log/mail.log
maxretry = 20
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 2m
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
[miab-roundcube]
enabled = true
port = http,https
filter = miab-roundcube
Fix path to Roundcube error log in fail2ban jails.conf (#1761)
2020-05-11 12:59:42 +00:00
logpath = /var/log/roundcubemail/errors.log
Ultra safe dovecot findtime and maxretry settings Explicitly set the timings and counts for the dovecot jail rather than change the global [DEFAULT] and inherit it for this one jail. These settings are far too safe so a future PR should increase security here.
2015-07-06 12:44:53 +00:00
maxretry = 20
Add own changes
2021-04-11 10:14:41 +00:00
findtime = 15m
Activate FAIL2BAN recidive jail Recidive can be thought of as FAIL2BAN checking itself. This setup will monitor the FAIL2BAN log and if 10 bans are seen within one day activate a week long ban and email the mail in a box admin that it has been applied . These bans survive FAIL2BAN service restarts so are much stronger which obviously means we need to be careful with them. Our current settings are relatively safe and definitely not easy to trigger by mistake e.g to activate a recidive IP jail by failed SSH logins a user would have to fail logging into SSH 6 times in 10 minutes, get banned, wait for the ban to expire and then repeat this process 9 further times within a 24 hour period. The default maxretry of 5 is much saner but that can be applied once users are happy with this jail. I have been running a stronger version of this for months and it does a very good job of ejecting persistent abusers.
2015-07-07 11:37:42 +00:00
[recidive]
enabled = true
maxretry = 10
Add own changes
2021-04-11 10:14:41 +00:00
bantime = 2w
findtime = 3d
Stop fail2ban recidive from sending emails, like all other jails
2016-03-26 08:04:51 +00:00
action = iptables-allports[name=recidive]
Add documentation on why the notification was removed from the recidive jail
2016-03-26 12:37:33 +00:00
# In the recidive section of jail.conf the action contains:
#
# action = iptables-allports[name=recidive]
# sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]
#
# The last line on the action will sent an email to the configured address. This mail will
# notify the administrator that someone has been repeatedly triggering one of the other jails.
# By default we don't configure this address and no action is required from the admin anyway.
# So the notification is ommited. This will prevent message appearing in the mail.log that mail
# can't be delivered to fail2ban@$HOSTNAME.
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
fail2ban ssh/ssh-ddos and sasl are now sshd and postfix-sasl (fixes #1453, merges #1454) * fail2ban ssh/ssh-ddos and sasl are now sshd and postfix-sasl * specified custom datepattern for miab-owncloud.conf
2019-01-18 14:36:43 +00:00
[postfix-sasl]
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
enabled = true
merge from 1804 version
2021-04-21 20:42:10 +00:00
findtime = 7d
[postfix]
enabled = true
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
simplify fail2ban configuration
2021-04-28 13:57:52 +00:00
# postfix rbl also found by postfix jail, but postfix-rbl is more aggressive (maxretry = 1)
[postfix-rbl]
enabled = true
fail2ban ssh/ssh-ddos and sasl are now sshd and postfix-sasl (fixes #1453, merges #1454) * fail2ban ssh/ssh-ddos and sasl are now sshd and postfix-sasl * specified custom datepattern for miab-owncloud.conf
2019-01-18 14:36:43 +00:00
[sshd]
Update jails.conf - SSH fail2ban jail (#1105) SSH fail2ban jail is not enabled by default and so the jail does not load.
2017-02-21 14:32:28 +00:00
enabled = true
Add own changes
2021-04-11 10:14:41 +00:00
maxretry = 4
add fail2ban jails for ownCloud, postfix submission, roundcube, and the Mail-in-a-Box management daemon (tests squashed into this commit by josh)
2016-04-13 21:52:13 +00:00
bantime = 3600
Add own changes
2021-04-11 10:14:41 +00:00
mode = aggressive
Reference in New Issue Copy Permalink