external
/
mailinabox
mirror of https://github.com/mail-in-a-box/mailinabox.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Activate FAIL2BAN recidive jail 

Recidive can be thought of as FAIL2BAN checking itself. This setup will monitor the FAIL2BAN log and if 10 bans are seen within one day activate a week long ban and email the mail in a box admin that it has been applied . These bans survive FAIL2BAN service restarts so are much stronger which obviously means we need to be careful with them.

Our current settings are relatively safe and definitely not easy to trigger by mistake e.g to activate a recidive IP jail by failed SSH logins a user would have to fail logging into SSH  6 times in 10 minutes, get banned, wait for the ban to expire and then repeat this process 9 further times within a single day.

The default maxretry of 5 is much saner but that can be applied once users are happy with this jail. I have been running a stronger version of this for months and it does a very good job of ejecting persistent abusers.
This commit is contained in:
anoma 2015-07-06 08:53:14 +01:00
parent 8de060ab45
commit bb3ccdca6c
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
conf/fail2ban/jail.local
View File

@ -13,3 +13,7 @@ enabled = true
filter = dovecotimap filter = dovecotimap
findtime = 30 findtime = 30
maxretry = 20 maxretry = 20
[recidive]
enabled = true
maxretry = 10