ASSP - Revision history

Daniel.subs: /* ASSP filter for Fail2ban */

2014-03-15T01:09:52Z

ASSP filter for Fail2ban

Daniel.subs: /* ASSP filter for Fail2ban */

2014-01-05T00:54:42Z

ASSP filter for Fail2ban

Daniel.subs: note its inclusion in mainline 0.8.9+

2013-11-12T22:42:28Z

note its inclusion in mainline 0.8.9+

Jlbrown at 00:37, 6 September 2010

2010-09-06T00:37:32Z

Jlbrown: There was no action specified in jail.conf

2010-09-06T00:36:23Z

There was no action specified in jail.conf

195.56.91.68: Fixed wording

2010-01-03T12:10:43Z

Fixed wording

195.56.91.68: Added contents for assp.conf

2010-01-03T12:09:21Z

Added contents for assp.conf

195.56.91.68: Fixed important tip.

2010-01-03T11:56:45Z

Fixed important tip.

195.56.91.68: Added ASSP filter and jail configuration

2010-01-03T11:54:54Z

Added ASSP filter and jail configuration

New page

== ASSP filter for Fail2ban ==

Save the attached '''assp.conf''' file into your '''/etc/fail2ban/filter.d''' directory.

Add this section to your '''/etc/fail2ban/jail.conf''' file:

[assp]

enabled = true
port = smtp,ssmtp
filter = assp
logpath = /var/log/assp/maillog.txt

'''IMPORTANT:''' Symlink your '''maillog.txt''' file from ASSP's log subdirectory to the above place or change the '''logpath''' accordingly.

Don't forget to '''restart fail2ban'''.

Check the end of your '''fail2ban.log''' whether fail2ban picked up ASSP's log file.

@@ Line 3: / Line 3: @@
 Included since fail2ban-0.8.9
-If you have an older version grab a copy of the filter from [https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/assp.conf Latest Version] or use this version (which is out of date). Place this in the file '''/etc/fail2ban/filter.d/assp.conf'''.
+If you have an older version grab a copy of the filter from [https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/assp.conf Latest Version]. Place this in the file '''/etc/fail2ban/filter.d/assp.conf'''.
-[Definition]
+Add this section to your '''/etc/fail2ban/jail.local''' file:
   [assp]

@@ Line 3: / Line 3: @@
 Included since fail2ban-0.8.9
-If you have an older version grab a copy of the filter from [https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/assp.conf Latest Version] or use this version (which may be out of date). Place this in the file '''/etc/fail2ban/filter.d/assp.conf'''.
+If you have an older version grab a copy of the filter from [https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/assp.conf Latest Version] or use this version (which is out of date). Place this in the file '''/etc/fail2ban/filter.d/assp.conf'''.
 <pre>

@@ Line 1: / Line 1: @@
 == ASSP filter for Fail2ban ==
-Create a new configuration file with the contents below: '''/etc/fail2ban/filter.d/assp.conf'''
+Included since fail2ban-0.8.9
- # Fail2Ban configuration file
+If you have an older version grab a copy of the filter from [https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/assp.conf Latest Version] or use this version (which may be out of date). Place this in the file '''/etc/fail2ban/filter.d/assp.conf'''.
-−
- # Author: Viktor Ferenczi (python <at-here> cx <dot-here> hu)
+<pre>
+# Fail2Ban filter for Anti-Spam SMTP Proxy Server also known as ASSP
-−
+#
- [Definition]
+#    Honmepage:   http://www.magicvillage.de/~Fritz_Borgstedt/assp/0003D91C-8000001C/
+#    ProjektSite: http://sourceforge.net/projects/assp/?source=directory
- # Option:  failregex
- # Notes.:  regex to match the SMTP failure messages in the logfile. The
- #          host must be matched by a group named "host". The tag "<HOST>" can
- #          be used for standard IP/hostname matching and is only an alias for
+[Definition]
- #          (?:::f{4,6}:)?(?P<host>\S+)
- # Values:  TEXT
+__assp_actions = (?:dropping|refusing)
-−
- # Example: Nov-14-09 00:14:50 54090-05322 201.244.255.72 <badguy@gtgwhhrthrth.com> [SMTP Error] 550 5.1.1 User unknown: your.user@your-domain.com
+failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors \(\d{,3}\) exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
- failregex = .*? \d{5}-\d{5} <HOST> <.*?> \[SMTP Error\] (.*)
+                        ^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
+                        ^ Blocking <HOST> - too much AUTH errors \(\d{,3}\);$
- # Option:  ignoreregex
- # Notes.:  regex to ignore. If this regex matches, the line is ignored.
+</pre>

@@ Line 34: / Line 34: @@
   port     = smtp,ssmtp
   filter   = assp
-  action  = iptables[name=ASSP, port=25, protocol=tcp]
+  action   = iptables[name=ASSP, port=25, protocol=tcp]
              sendmail-whois[name=ASSP, dest=email@domain.com]
   logpath  = /var/log/assp/maillog.txt

@@ Line 1: / Line 1: @@
 == ASSP filter for Fail2ban ==
-Save the following into the '''/etc/fail2ban/filter.d/assp.conf''' file:
+Create a new configuration file with the contents below: '''/etc/fail2ban/filter.d/assp.conf'''
   # Fail2Ban configuration file

@@ Line 13: / Line 13: @@
-'''IMPORTANT:''' Symlink your '''maillog.txt''' file from ASSP's log subdirectory to the above place or change the '''logpath''' accordingly.
+'''IMPORTANT:''' Symlink the '''logs''' subdirectory of your ASSP installation as '''/var/log/assp''' or change the '''logpath''' in your jail configuration to point to ASSP's '''maillog.txt''' file.
 Don't forget to '''restart fail2ban'''.
 Check the end of your '''fail2ban.log''' whether fail2ban picked up ASSP's log file.