Failtoban

Anticloudazure

Hello!

I was asking the same question a few weeks ago in german. Nobody answered. I am trying again in english so hopefully I am reaching more readers.

My question is about failtoban.

In the webinterface I can configure failtoban parameters. At the bottom of this page a banned IP (if there is one) should be listed, I never saw one. The only Information about fail to bans activities are listed in the netfilter log.

Am I missing something understood wrong?

Thank you for your help!

ETNyx

As far as I know you are not missing much.

There was some bugs affecting this part already solved. Also in some update there was mandatory manual action about resting regex filters.

So if you are updated, did not miss that action you are fine.

Default settings of fail2ban (netfilter) are pretty loose.. Unless you are targeted by some brutal force, high intense attack you will not se any bans,… Check this docker compose logs netfilter-mailcow | grep "Banning" on stock config I see 3 bans in last month all only for 30 minutes. To be able to see them in UI you must sit there all the time,…

Ganzjahresgriller

My settings are a bit more aggressive. However, I should also mention that this is a private mail server. And there are several accounts on the server that are constantly under attack. I haven’t had any problems with these settings for about a year.

CK_beats

Ganzjahresgriller

My settings are even a little more restrictive.
The whole thing in productive operation.

So far no restrictions.
Since a sending email server does not attempt any authentication, there are no errors in email transmission

ETNyx

Just note /24 on IPv4 ban 256 addresses, it may be fine or not. One mistake can lock out let’s say whole company instead of one department. So if you want to change this be aware,..

Ganzjahresgriller

For me it’s fine 🙂

Anticloudazure

Thank you!

ETNyx

That’s interesting. Have you ever done any analysis for Fail2ban? Specifically, I’m curious about the fact that you’re only restricting IPv4 more than /32 and only /128 block for IPv6 as a single address. Typically, when you request an address, a /64 block is assigned. That’s also what the standard recommends. In my opinion, we need to make a mental shift here: IPv4/32 = IPv6/64 by default,…

CK_beats

ETNyx
You’re right. Thank you for the tip! /128 IPv6 has been adjusted.
I usually watch the logs for this every day.
At the IPv6 level everything is quiet so far. Only the major email servers like Google and Microsoft send your emails here. Otherwise there is currently no unwanted contact on the server. Everything happens on IPv4 level.

Ganzjahresgriller

I’m not currently experiencing any problems with IPv6; only a very small number of servers are sending via IPv6. And for most attacks, IPv6 is probably still too new. 🙂