Hi,
we have recently been hit by a couple of brute force password attacks against dovecot. So what I want to do now is to add dovecot to fail2ban in order to block further attacks.
However, I don't seem to be able to find out password verifification failures for our LDAP based user data.
The only thing I see are loads of lines like these in the logfiles:
-------CUT------- dovecot: Nov 30 09:09:51 Info: pop3-login: Disconnected: user=<ludovic>, method=PLAIN, rip=217.147.235.52, lip=81.16.98.99 dovecot: Nov 30 09:09:51 Info: pop3-login: Disconnected: user=<luna>, method=PLAIN, rip=217.147.235.52, lip=81.16.98.99 dovecot: Nov 30 09:09:51 Info: pop3-login: Disconnected: user=<luke>, method=PLAIN, rip=217.147.235.52, lip=81.16.98.99 -------CUT-------
Googling the web I found that PAM based authentication obviously gives a matchable error message, but for some reasons the ldap backend does not
- or does it?
Any pointers highly appreciated :-)
dovecot -n says this:
-------CUT------- # 1.0.15: /etc/dovecot/dovecot.conf log_path: /var/log/dovecot.log protocols: imaps imap pop3 listen: 81.16.98.99 ssl_listen(default): 81.16.98.99 ssl_listen(imap): 81.16.98.99 ssl_listen(pop3): ssl_cert_file: /etc/bestsolution/ssl/mail.bestsolution.at-cert.pem ssl_key_file: /etc/bestsolution/ssl/mail.bestsolution.at-key.pem ssl_parameters_regenerate: 24 disable_plaintext_auth: no login_dir: /var/run/dovecot/login login_executable(default): /usr/lib/dovecot/imap-login login_executable(imap): /usr/lib/dovecot/imap-login login_executable(pop3): /usr/lib/dovecot/pop3-login first_valid_uid: 9 mail_access_groups: mail mail_privileged_group: mail default_mail_env: mbox:~/mail/:INBOX=/var/mail/%u mail_location: mbox:~/mail/:INBOX=/var/mail/%u mmap_disable: yes lock_method: dotlock maildir_copy_with_hardlinks: yes mail_executable(default): /usr/lib/dovecot/imap mail_executable(imap): /usr/lib/dovecot/imap mail_executable(pop3): /usr/lib/dovecot/pop3 mail_plugin_dir(default): /usr/lib/dovecot/modules/imap mail_plugin_dir(imap): /usr/lib/dovecot/modules/imap mail_plugin_dir(pop3): /usr/lib/dovecot/modules/pop3 pop3_uidl_format(default): pop3_uidl_format(imap): pop3_uidl_format(pop3): %v.%u auth default: mechanisms: plain digest-md5 cram-md5 login passdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf userdb: driver: ldap args: /etc/dovecot/dovecot-ldap.conf socket: type: listen client: path: /var/spool/postfix/private/auth mode: 432 user: postfix group: postfix -------CUT-------
-- Udo Rader, CTO http://www.bestsolution.at