<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Times New Roman, Times, serif">Hi Marcus , <br>
<br>
</font><br>
<div class="moz-cite-prefix">On 10/17/2015 04:33 PM, Marcus Schopen
wrote:<br>
</div>
<blockquote cite="mid:1445079796.29325.6.camel@cosmo" type="cite">
<pre wrap="">Hi Jayesh ,
Am Samstag, den 17.10.2015, 13:06 +0530 schrieb Jayesh Shinde:
</pre>
<blockquote type="cite">
<pre wrap="">Hello all ,
I am having mailserver with centos 6.3 + cyrus-imad + postfix + ldap
We are using cyrus-sasl-2.1.23-13.el6.x86_64 with 'PAM' Mechanism .
Many spammer are trying to hack password for doing many authentication
with pop3 + imap + smtp services.
on server Fail2ban hass been added , but its blocking hacker IPs
after certain interval and not in real time. Which is the actual
issue.
I am looking for some real-time blocking where that particular
spammer IP + email id must get block .
</pre>
</blockquote>
<pre wrap="">
I'm using fail2ban too and I don't understand what you mean by "real
time". In my configuration the ban is set immediately after three failed
logins (no delay) and for more extended banning of persistent abusers I
use the recidive filter.
</pre>
</blockquote>
<font face="Times New Roman, Times, serif">I think I am missing
something with fail2ban. <br>
I am looking for immediate source IP blocking after 3 wrong
attempt for this for pop / imap / smtp login failure. <br>
<br>
Can you please share your correct configuration. That will help me
to understand the regex part matching.<br>
<br>
What is your suggestion for below 3 points. </font><br>
<blockquote cite="mid:1445079796.29325.6.camel@cosmo" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I believe this issue is very common with other too , is there any
option in 'saslauthd' / postfix / cyrus-imapd for below
requirement ?
1) If server receive the wrong password , then is it possible to
introduce the delay of say 5-10 seconds to sender client ? So that
spammer will do less attempt ?
2) After given wrong password attempt more than 3 time , the
particular "IP + email id" must get block for next 5-10 min.
And then need to unblock after that.
3) I check PAM-ABL , but its not working for 'saslauthd'' with pop /
imap / smtp . Because I came to know that 'saslauthd'' is not getting
IP of source .
How to pass source IP to "saslauthd'' along with email id , password
and relam . Is there any patch available for this ?
</pre>
</blockquote>
<pre wrap="">
Ciao!
</pre>
</blockquote>
<br>
</body>
</html>