主页 / user-172876

Kenny's questions

Martin Hope
Kenny
Asked: 2020-04-01 21:09:01 +0800 CST
  • 5

Debian Stretch - roundcube-auth 不禁止从 IP 登录失败。似乎 fileregex 与记录的失败登录不匹配。

从 roundcube 登录 /var/log/mail.log 失败就像

Mar 30 16:15:31 debian roundcube[13209]: <ppt6hqpa> IMAP Error: Login failed for user@domain.com against localhost from 255.255.255.255. LOGIN: Login failed. in /var/www/html/roundcube/program/lib/Roundcube/rcube_imap.php on line 200 (POST /roundcube/?_task=login&_action=login)
Mar 30 16:15:32 debian roundcube[13209]: <ppt6hqpa> Failed login for user@domain.com from 255.255.255.255 in session ppt6hqpajq3nup5v (error: 0)

fail2ban -roundcube-auth.conf

[INCLUDES]

before = common.conf

[Definition]
failregex = ^\s*(\[\])?(%(__hostname)s\s*(roundcube:)?\s*(<[\w]+>)? IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
                ^\[\]:\s*(<[\w]+>)? Failed login for [\w\-\.\+]+(@[\w\-\.\+]+\.[a-zA-Z]{2,6})? from <HOST> in session \w+( \(error: \d\))?$

fail2ban - jail.conf

[roundcube-auth]

port     = http,https
#logpath  = %(roundcube_errors_log)s
logpath  = /var/log/mail.log
enabled = true
maxretry = 2
bantime = 3600

fail2ban-客户端状态

fail2ban-client status
Status
|- Number of jail:      9
`- Jail list:   apache-badbots, courier-auth, postfix, postfix-ispmail, postfix-sasl, proftpd, roundcube-auth, squirrelmail, sshd

fail2ban-client 状态 roundcube-auth

Status for the jail: roundcube-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- File list:        /var/log/mail.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:
debian fail2ban
Martin Hope
Kenny
Asked: 2019-07-25 02:42:52 +0800 CST
  • 5

当我尝试从垃圾邮件隔离区释放电子邮件时，我有 amavisd-release 版本 2.002 我必须输入 secred_id 但我没有 sql amavisd 隔离区 - 只有本地

amavisd-release spam-id.gz 450 4.5.0 Failure: Secret_id is equired, but missing at (eval 92) line 286, <GEN104> line 5.

我正在使用隔离 ID 并且没有 secret_id。

在脚本 amavisd-release 中我有代码

$socketname = '127.0.0.1:9998';

在 amavisd 配置中有

$interface_policy{'9998'} = 'AM.PDP';
$policy_bank{'AM.PDP'} = { protocol=>'AM.PDP' };
$inet_socket_port = [10024,9998];

当我没有 sql 隔离方法时，也许我必须更改 smth 才能工作？

请帮忙

amavis