[RCU] Fail2ban and roundcube on CentOS 8

SM Hosting.sk admin at smhosting.sk
Sat Dec 28 16:32:54 CET 2019


Hi, you are missing <HOST> in the rule

failregex = (.*) IMAP Error: Login failed for .* from <HOST>

Or give this a try:

[INCLUDES]

before = common.conf

[Definition]

prefregex = 
^\s*(\[\])?(%(__hostname)s\s*(?:roundcube(?:\[(\d*)\])?:)?\s*(<[\w]+>)? 
IMAP Error)?: <F-CONTENT>.+</F-CONTENT>$

failregex = ^(?:FAILED login|Login failed) for <F-USER>.*</F-USER> from 
<HOST>(?:(?:\([^\)]*\))?\. (?:(?! from ).)*(?: user=(?P=user))? in 
\S+\.php on line \d+ \(\S+ \S+\))?$
                   ^(?:<[\w]+> )?Failed login for <F-USER>.*</F-USER> 
from <HOST> in session \w+( \(error: \d\))?$

ignoreregex =

journalmatch = SYSLOG_IDENTIFIER=roundcube

Miro.

Dňa 28. 12. 2019 o 15:43 Davide Perini napísal(a):
> Hi all, guys.
> Hope you are doing well on this holidays.
>
> Is there someone who has fail2ban working on Centos 8 and roundcubemail?
>
> My /var/log/roundcubemail/errors.log
> looks like this
> [28-Dec-2019 14:27:32 +0000]: <p2otg3ug> IMAP Error: Login failed for 
> perini.davide against localhost from ::1. AUTHENTICATE PLAIN: 
> Authentication failed. in 
> /usr/share/roundcubemail/program/lib/Roundcube/rcube_imap.php on line 
> 200 (POST /webmail/?_task=login&_action=login)
>
> my roundcube.conf looks like this
>
> [Definition]
> failregex = (.*) IMAP Error: Login failed for .* from
> ignoreregex =
>
>
> What is the problem?
> Any idea?
>
> Thanks
> _______________________________________________
> Roundcube Users mailing list
> users at lists.roundcube.net
> http://lists.roundcube.net/mailman/listinfo/users


More information about the users mailing list