Fail2Ban: login_log filter webmaild

Bouke

• December 26, 2017 14:33

Hello, I would like to use a Fail2Ban filter for the cPanel login_log (/usr/local/cpanel/logs). Unfortunately I am not experienced with these filters. I can't figure out a working regex for webmaild. I would like to filter rules like these: [2017-12-26 20:59:45 +0100] info [webmaild] 123.123.123.123 - test2@domain.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist) [2017-12-26 21:00:59 +0100] info [webmaild] 123.123.123.123 - test1@domain.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect I am not sure how to write the required failregex lines. I am hoping some could kindly help me, please.

• 

  rpvw

  • December 26, 2017 20:05

  You might like to consider CSF/LFD that has a built in rule for login failure detection of cpanel, webmail and whm connections. More details at : How to Configure Your Firewall for cPanel Services - cPanel Knowledge Base - cPanel Documentation

  0
• 

  cPanelMichael

  • December 27, 2017 17:07

  Hello, I concur with @rpvw. CSF is likely the best approach if you'd like to avoid writing custom rules. Thank you.

  0
• 

  Bouke

  • December 29, 2017 17:38

  You might like to consider CSF/LFD that has a built in rule for login failure detection of cpanel, webmail and whm connections.

  
  Many thanks as this is very helpful. I am surprised that CSF works out of the box (although I have changed some things).

  0

Please sign in to leave a comment.