垃圾郵件發送者正在我的伺服器（Debian 上的 postfix）上執行暴力密碼猜測攻擊。他們已經猜出了兩個用戶的密碼並開始使用我的伺服器發送垃圾郵件。密碼已更改且攻擊已緩解（目前），但我想完全阻止它們。
我安裝了fail2ban，但由於某種原因它無法偵測到攻擊。
/etc/fail2ban/fail.conf包含：
[sasl]
enabled = true
port = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3s
filter = sasl
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
#logpath = /var/log/mail.log
logpath = /var/log/mail.warn
/etc/fail2ban/filter.d/sasl.conf包含：
# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision$
#
[Definition]
# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "<HOST>" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
當我在 上運行過濾器時/var/log/mail.warn，它會產生結果：
# fail2ban-regex /var/log/mail.warn '(?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$'
Running tests
=============
Use regex line : (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|P...
Use log file : /var/log/mail.warn
Results
=======
Failregex
|- Regular expressions:
| [1] (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
|
`- Number of matches:
[1] 15293 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
123.169.7.222 (Sun Feb 25 06:40:18 2018)
123.169.7.222 (Sun Feb 25 06:40:21 2018)
...
185.173.176.157 (Fri Mar 02 10:12:46 2018)
185.173.176.157 (Fri Mar 02 10:13:15 2018)
185.173.176.157 (Fri Mar 02 10:13:43 2018)
185.173.176.157 (Fri Mar 02 10:14:11 2018)
185.173.176.157 (Fri Mar 02 10:14:41 2018)
185.173.176.157 (Fri Mar 02 10:15:13 2018)
185.173.176.157 (Fri Mar 02 10:15:42 2018)
185.173.176.157 (Fri Mar 02 10:16:13 2018)
185.173.176.157 (Fri Mar 02 10:16:42 2018)
185.173.176.157 (Fri Mar 02 10:17:10 2018)
Date template hits:
34294 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Year.Month.Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
0 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@Hour:Minute:Second>
Success, the total number of match is 15293
However, look at the above section 'Running tests' which could contain important
information.
儘管如此，/var/log/fail2ban.log並沒有顯示出對違規 IP 位址的封鎖。
更新
根據建議，我提高了日誌等級。由此可見：
2018-03-02 12:47:55,920 fail2ban.filter : DEBUG Processing line with time:1519986602.0 and ip:185.173.176.157
2018-03-02 12:47:55,920 fail2ban.filter : DEBUG Ignore line since time 1519986602.0 < 1519987675.92 - 600
2018-03-02 12:47:55,920 fail2ban.filter : DEBUG Processing line with time:1519986635.0 and ip:185.173.176.157
2018-03-02 12:47:55,920 fail2ban.filter : DEBUG Ignore line since time 1519986635.0 < 1519987675.92 - 600
Jail.conf 有：
bantime = 600
maxretry = 3
答案1
從Ignore line since time 1519986602.0 < 1519987675.92 - 600日誌記錄和文件，我認為這600就是選擇權的價值findtime。也就是說，來自給定 IP 的破解嘗試的步幅似乎大於findtime，因此會被 忽略fail2ban。
1519987675.92-1519986602.0大約需要1073.9218 分鐘。
防彈解決方案將強制在面向網際網路的介面上使用 TLS，並強制驗證用戶端提供的憑證是否由受信任的 CA 核發。