fail2ban/fail2ban — Issue #18: Filter for imapd/ipop3d
Author: cepheid666
Created: 2011-12-30 07:30:47+00:00
State: open

I noticed there wasn't a filter available for imapd/ipop3d, the IMAP/POP3 daemons from uw-imap. These are still relatively common, so I made a filter for them. If one's system is using PAM then the standard PAM filter could be used instead, but this allows for a standalone filter based purely on uw-imap.

The filter file (ipop3d.conf) is as follows:

```
# Fail2Ban configuration file
#
# Author: Amir Caspi
#
# $Revision: 1 $

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = (?:ipop3d|imapd)

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
# host must be matched by a group named "host". The tag "" can
# be used for standard IP/hostname matching and is only an alias for
# (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values: TEXT
#
failregex = ^%(__prefix_line)sLogin (?:failed|excessive login failures) user=\S* auth=\S* host=.*\[\]\s*$

# Option: ignoreregex
# Notes.: regex to ignore. If this regex matches, the line is ignored.
# Values: TEXT
#
ignoreregex =
```

The jail settings I use in jail.conf, for reference, are:

```
[ipop3d]

enabled = true
filter = ipop3d
action = iptables-multiport[name=IPOP, port="pop3,pop3s,imap,imaps", protocol=tcp]
sendmail-whois-lines[name=IPOP, dest=root, sender=fail2ban@mail.com, logpath=/var/log/messages]
logpath = /var/log/messages
maxretry = 5
```

Please feel free to incorporate this into the next release; hopefully this will be useful for other uw-imap users.