I am using fail2ban on my mail server. I discovered this morning that there were some 500 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here is an example of an entry in /var/log/maillogJun 23 18:26:46 *** postfix/smtpd[22970]: warning: m85-94-174-103.andorpac.ad[85.94.174.103]: SASL PLAIN authentication failed: authentication failureJun 23 18:26:46 *** postfix/smtpd[22970]: warning: m85-94-174-103.andorpac.ad[85.94.174.103]: SASL LOGIN authentication failed: authentication failureJun 23 18:26:46 *** postfix/smtpd[22970]: warning: m85-94-174-103.andorpac.ad[85.94.174.103]: SASL CRAM-MD5 authentication failed: authentication failureJun 23 18:26:47 *** postfix/smtpd[22968]: warning: unknown[27.54.122.28]: SASL PLAIN authentication failed: authentication failurePlesk   12.5.30 Update #67Ubuntu 12.04.5 LTSjail plesk-postfix:[plesk-postfix]enabled = truefilter = postfix-saslaction = iptables-multiport[name=plesk-postfix, port=smtp,smtps,submission]logpath = /var/log/maillogmaxretry = 5jail-filter postfix-sasl:[INCLUDES]before = common.conf[Definition]_daemon = postfix/(submission/)?smtp(d|s)failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$ignoreregex = authentication failed: Connection lost to authentication server$[Init]journalmatch = _SYSTEMD_UNIT=postfix.serviceadmin/server-protection/log-view/id/fail2ban.log:2017-06-23 19:15:16,652 fail2ban.filter [11355]: INFO [plesk-postfix] Found 46.238.43.2332017-06-23 19:15:37,234 fail2ban.filter [11355]: INFO [plesk-postfix] Found 190.15.40.562017-06-23 19:15:37,927 fail2ban.filter [11355]: INFO [plesk-postfix] Found 188.173.133.1972017-06-23 19:15:38,202 fail2ban.filter [11355]: INFO [plesk-postfix] Found 188.173.133.1972017-06-23 19:15:38,637 fail2ban.filter [11355]: INFO [plesk-postfix] Found 188.173.133.1972017-06-23 19:15:39,072 fail2ban.filter [11355]: INFO [plesk-postfix] Found 190.15.40.562017-06-23 19:15:39,623 fail2ban.filter [11355]: INFO [plesk-postfix] Found 190.15.40.562017-06-23 19:15:51,306 fail2ban.filter [11355]: INFO [plesk-postfix] Found 112.231.76.1392017-06-23 19:15:54,217 fail2ban.filter [11355]: INFO [plesk-postfix] Found 112.231.76.1392017-06-23 19:15:55,649 fail2ban.filter [11355]: INFO [plesk-postfix] Found 112.231.76.139ps: log time match server time
Fail2Ban SASL Filter Misses Failed Logins
postfix;fail2ban;sasl