Hello there, I've got a question about the fail2ban configuration. Watchdog sends you infos about IP bans from fail2ban that look like this: [upl-image-preview url=https://community.mailcow.email/assets/files/2020-07-11/1594462890-685804-image.png] 1. How can I configure the time a specific IP is being banned? 2. As i understand it the mailcow fail2ban only monitors web login failures, what would be the best way to expand it to also monitor ssh fails? Is it even possible or do I need to set that up on the host? If I have to set up a secopnd fail2ban instance, how can I set up communications with watchdog? Thanks, Kiriakos

Hi, [upl-image-preview url=https://community.mailcow.email/assets/files/2020-07-11/1594469023-740687-image.png] It monitors _all_ interfaces of mailcow. Mail, web, etc. For your hosts SSH service use fail2ban on your host. André

Configure Fail2Ban

kiriakos

Hello there,

I’ve got a question about the fail2ban configuration. Watchdog sends you infos about IP bans from fail2ban that look like this:

How can I configure the time a specific IP is being banned?
As i understand it the mailcow fail2ban only monitors web login failures, what would be the best way to expand it to also monitor ssh fails? Is it even possible or do I need to set that up on the host? If I have to set up a secopnd fail2ban instance, how can I set up communications with watchdog?
Thanks,
Kiriakos

diekuh

Hi,

It monitors all interfaces of mailcow. Mail, web, etc.

For your hosts SSH service use fail2ban on your host.

André

ovizii

Any way to configure fail2ban?

i.e. usually I have it also email me the reason why it was blocked, i.e.

The IP 212.70.149.3 has just been banned by Fail2Ban after
5 attempts against "jail_name".

and at the end of the report the relevant log lines, i.e.


Lines containing IP:212.70.149.3 in /var/log/messages

Aug  6 22:51:31 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Ban 212.70.149.3
Aug  7 10:51:31 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Unban 212.70.149.3
Aug  7 10:53:02 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Ban 212.70.149.3
Aug  7 22:53:02 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Unban 212.70.149.3
Aug  7 22:54:43 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Ban 212.70.149.3
Aug  8 10:54:43 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Unban 212.70.149.3
Aug  8 10:56:07 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Ban 212.70.149.3
Aug  8 22:56:08 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Unban 212.70.149.3
Aug  8 22:57:36 jacob fail2ban.actions[3087]: NOTICE [postfix-sasl] Ban 212.70.149.3
Aug  8 22:57:37 jacob fail2ban.actions[3087]: NOTICE [recidive] Ban 212.70.149.3