From 0c1470720113873b39a31860f6b7fc7c2f62be9c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 26 Oct 2013 10:01:04 +1100 Subject: [PATCH 1/5] ENH: add dovecot jail --- config/jail.conf | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index 594dfc3b..c30b50e8 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -472,5 +472,9 @@ filter = webmin-auth action = iptables-multiport[name=webmin,port="10000"] logpath = /var/log/auth.log - +[dovecot] +enabled = false +filter = dovecot +action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp] +logpath = /var/log/secure From cde389cadc8473c14b17b927bdaa3a85704d2d84 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 29 Oct 2013 10:15:54 +1100 Subject: [PATCH 2/5] ENH: additional tweek to dovecot regex based on http://chrisgilligan.com/portfolio/fail2ban-regex/ --- config/filter.d/dovecot.conf | 2 +- testcases/files/logs/dovecot | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf index 51c28af4..dd0e7678 100644 --- a/config/filter.d/dovecot.conf +++ b/config/filter.d/dovecot.conf @@ -9,7 +9,7 @@ before = common.conf [Definition] -_daemon = (dovecot(-auth)?|auth-worker) +_daemon = (auth|dovecot(-auth)?|auth-worker) # Option: failregex # Notes.: regex to match the password failures messages in the logfile. # first regex is essentially a copy of pam-generic.conf diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot index 733552df..80313b75 100644 --- a/testcases/files/logs/dovecot +++ b/testcases/files/logs/dovecot @@ -35,3 +35,7 @@ Jul 02 13:49:32 hostname dovecot[442]: dovecot: auth(default): pam(account@MYSER # failJSON: { "time": "2013-08-11T03:56:40", "match": true , "host": "1.2.3.4" } 2013-08-11 03:56:40 auth-worker(default): Info: pam(username,1.2.3.4): pam_authenticate() failed: Authentication failure (password mismatch?) + +# failJSON: { "time": "2005-05-19T05:22:20", "match": true , "host": "80.255.3.104" } +Apr 19 05:22:20 vm5 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=informix rhost=80.255.3.104 + From 8412303131235aafb2405824323b1534deb5f85c Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 29 Oct 2013 10:17:45 +1100 Subject: [PATCH 3/5] ENH: dovecot jail examples --- config/jail.conf | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/config/jail.conf b/config/jail.conf index c30b50e8..60bb23c6 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -472,9 +472,16 @@ filter = webmin-auth action = iptables-multiport[name=webmin,port="10000"] logpath = /var/log/auth.log +# dovecot defaults to logging to the mail syslog facility +# but can be set by syslog_facility in the dovecot configuration. [dovecot] enabled = false filter = dovecot action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp] -logpath = /var/log/secure +logpath = /var/log/mail.log +[dovecot-auth] +enabled = false +filter = dovecot +action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps", protocol=tcp] +logpath = /var/log/secure From a991adb83f7197e537a5d1b9242470a5c2729416 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Tue, 29 Oct 2013 14:33:45 +1100 Subject: [PATCH 4/5] ENH: add submission, smtps and sieve to blocked ports since this also typically rely on dovecot auth --- config/jail.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/jail.conf b/config/jail.conf index 60bb23c6..1154cb52 100644 --- a/config/jail.conf +++ b/config/jail.conf @@ -477,11 +477,11 @@ logpath = /var/log/auth.log [dovecot] enabled = false filter = dovecot -action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp] +action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps,submission,smtps,sieve", protocol=tcp] logpath = /var/log/mail.log [dovecot-auth] enabled = false filter = dovecot -action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps", protocol=tcp] +action = iptables-multiport[name=dovecot-auth, port="pop3,pop3s,imap,imaps,submission,smtps,sieve", protocol=tcp] logpath = /var/log/secure From 7596b96d4f3e04e1d1b07d16eaaeb2e5fa009862 Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Wed, 30 Oct 2013 09:05:09 +1100 Subject: [PATCH 5/5] TST: fix date in test comparison for dovecot --- testcases/files/logs/dovecot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/testcases/files/logs/dovecot b/testcases/files/logs/dovecot index 80313b75..d2aa59ca 100644 --- a/testcases/files/logs/dovecot +++ b/testcases/files/logs/dovecot @@ -36,6 +36,6 @@ Jul 02 13:49:32 hostname dovecot[442]: dovecot: auth(default): pam(account@MYSER # failJSON: { "time": "2013-08-11T03:56:40", "match": true , "host": "1.2.3.4" } 2013-08-11 03:56:40 auth-worker(default): Info: pam(username,1.2.3.4): pam_authenticate() failed: Authentication failure (password mismatch?) -# failJSON: { "time": "2005-05-19T05:22:20", "match": true , "host": "80.255.3.104" } +# failJSON: { "time": "2005-04-19T05:22:20", "match": true , "host": "80.255.3.104" } Apr 19 05:22:20 vm5 auth: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=informix rhost=80.255.3.104