WIKI webhosting

Fail2Ban is a security tool that scans application log files and automatically blocks IP addresses showing signs of malicious activity. In this article, you will learn how to set up and use Fail2Ban to protect Dovecot (a popular IMAP and POP3 server) and Postfix (a widely-used SMTP server) on a CentOS 7 server.

Prerequisites

• Access to a CentOS 7 server with superuser (root) privileges.
• Installed and running Dovecot and Postfix services.

Installing Fail2Ban

1. System Update: First, update your system using the yum update command to ensure all your packages are up to date.

2. Fail2Ban Installation: Install Fail2Ban using the yum install fail2ban command. If it's not in the default repositories, you may need to add the EPEL repository using yum install epel-release.

Configuring Fail2Ban

Fail2Ban uses configuration files in INI format. The default configuration file is jail.conf, but it's recommended to create a copy of this file named jail.local so your changes won't be overwritten during Fail2Ban updates.

1. Creating jail.local: Copy the default configuration file to jail.local using the cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local command.

2. Configuration for Dovecot and Postfix: Open jail.local in a text editor and add or modify sections for Dovecot and Postfix. These sections define how Fail2Ban monitors the log files of these services and how it reacts to detected intrusion attempts.

Example Configuration for Dovecot:

[dovecot]
enabled = true
filter = dovecot
action = iptables-multiport[name=Dovecot, port="imap,imaps,pop3,pop3s", protocol=tcp]
logpath = /var/log/maillog
maxretry = 5

Example Configuration for Postfix:

[postfix]
enabled = true
filter = postfix
action = iptables-multiport[name=Postfix, port="smtp,smtps,submission", protocol=tcp]
logpath = /var/log/maillog
maxretry = 5

Activation and Testing

After completing the configuration, restart the Fail2Ban service using systemctl restart fail2ban. Ensure the service is running by using systemctl status fail2ban.

Logs and Diagnostics

Fail2Ban keeps logs that can be useful for diagnostics and monitoring of attacks. You can find logs in /var/log/fail2ban.log.

 

Setting up Fail2Ban to protect Dovecot and Postfix on CentOS 7 is a straightforward and effective solution for enhancing the security of your mail server. Thorough configuration and regular monitoring of logs will help protect your system from unauthorized access and potential attacks.