Recently I get a lot of attacks on my postfix server with users trying to log in with wrong credentials and in my eyes the goal to get to know the passworts of some of the users to send spam.To protect my infrastructure and my users I tried to set up fail2ban to protect postfix. But my guess is that fail2ban is unable to read the date and thus doesn't ban the atteackers as it doesn't know in which periode the attacks came. I will give you an example of my logs and the configuration.My System: CentOS Linux release 7.3.1611 (Core)fail2ban Version 0.9.6 maillog (some of the attacks):Mar  4 15:53:05 localhost postfix/submission/smtpd[24494]: disconnect from host6.cookingate.com[194.63.142.103]Mar  4 15:53:05 localhost postfix/submission/smtpd[24494]: connect from host6.cookingate.com[194.63.142.103]Mar  4 15:53:11 localhost postfix/submission/smtpd[24494]: warning: host6.cookingate.com[194.63.142.103]: SASL PLAIN authentication failed:Mar  4 15:53:11 localhost postfix/submission/smtpd[24494]: disconnect from host6.cookingate.com[194.63.142.103]Mar  4 15:53:11 localhost postfix/submission/smtpd[24494]: connect from host6.cookingate.com[194.63.142.103]Mar  4 15:53:18 localhost postfix/submission/smtpd[24494]: warning: host6.cookingate.com[194.63.142.103]: SASL PLAIN authentication failed:Mar  4 15:53:18 localhost postfix/submission/smtpd[24494]: disconnect from host6.cookingate.com[194.63.142.103]Mar  4 19:44:15 localhost postfix/smtpd[27204]: warning: unknown[195.22.126.189]: SASL LOGIN authentication failed: Invalid authentication mechanismMar  4 19:44:15 localhost postfix/smtpd[27204]: disconnect from unknown[195.22.126.189]Test of mail postfix-sasl filter (/etc/fail2ban/filter.d/postfix-sasl.conf) fail2ban-regex /var/log/maillog /etc/fail2ban/filter.d/postfix-sasl.bkpRunning tests=============Use   failregex filter file : postfix-sasl, basedir: /etc/fail2banUse         log file : /var/log/maillogUse         encoding : UTF-8Results=======Failregex: 62 total|-  #) [# of hits] regular expression|   1) [62] (?i): warning: [-._\w]+\[<HOST>\]:(\d*?:)? SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \wIgnoreregex: 0 totalDate template hits:|- [# of hits] date format|  [26244] (?:DAY )?MON Day 24hour:Minute:Second(?:\.Microseconds)?(?: Year)?Lines: 26244 lines, 0 ignored, 62 matched, 26182 missed[processed in 4.11 sec]Missed line(s): too many to print.  Use --print-all-missed to print all 26182 linesjail.local[INCLUDES]before = paths-fedora.confbackend = systemdusedns = warnlogencoding = autoenabled = falsefilter = %(__name__)schain = INPUTport = 0:65535fail2ban_agent = Fail2Ban/%(fail2ban_version)sbanaction = iptables-multiportbanaction_allports = iptables-allports[postfix-sasl]enabled = trueport     = smtp,465,587,submission,imap3,imaps,pop3,pop3sfilter = postfix-sasllogpath = /var/log/maillogbackend  = %(postfix_backend)smaxretry = 3findtime = 6000bantime = 86400postfix-sasl.conf Filter used in jail local for chekcing postfix logs. As you can see I already tried differend kind of filter patterns to see a difference.[INCLUDES]before = common.conf[Definition] _daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]#failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:[ A-Za-z0-9+/:]*={0,2})?\s*$failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:[A-Za-z0-9+/ ]*)?$ignoreregex = authentication failed: Connection lost to authentication server$[Init]journalmatch = _SYSTEMD_UNIT=postfix.serviceLooking at the output from the filter check my suspiction is that fail2ban has problems identifying the date / time format and thus can't ban attackers. Do you have an idea how I can make fail2ban (which normaly should autodetect the date and time format) understand the format?Thanks so much,Holger
How to get fail2ban recognize the date format on CentOS 7?
centos;security;iptables;postfix;fail2ban