1

Topic: Fail2ban blocking user

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.6
- Linux/BSD distribution name and version: Ubuntu 16.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Web server (Apache or Nginx): Nginx
- Manage mail accounts with iRedAdmin-Pro? No
- Related log if you're reporting an issue: iptables
====
Hi Everyone,

I am having an issue with one of my users. I run a small server at the moment with 4 domains and about 7 users. All with no issues except for one. He does send and receive more email than the rest of the users on my server, but by no means crazy amounts, +/- 30 outbound and inbound each day.

The problem is that, which I have just figured out after a couple days, is that fail2ban keeps blocking his ip addresses. No matter where he connects from, it keeps on banning his ip after a connection to the server. He connects from multiple devices, iphone, macbook at home and a windows machine at work, all having the mail properly configured on each device.

Every IP gets banned after one or two connections from any of the networks involved, fiber at home, fiber at office and LTE/3G network on phone. Running iptables -L I can see each of the IP's from the different locations all discussed here.

Please can someone give me some insight into how I can go about fixing this, as all of the IPs are dynamic ips and therefore change daily, or on the iphone each time a different tower is used.

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Fail2ban blocking user

This doesn't make much sense to me sad

Fail2ban only blocks user when he triggered few failures (like incorrect password, etc), but sometimes some MUA will cause server-side software (Postfix/Dovecot/etc) generates bad log and caught by fail2ban. What you need to do is checking Fail2ban log to see which fail2ban filter caught this user. if the filter itself is not good enough, either fix it or simply remove it.

3

Re: Fail2ban blocking user

Hi Zhang,

So I did a bit of fishing around and also with some help from a guy in the fail2ban irc chat, found the problem.

The issue was that the fail2ban dovecot rule had been modified a couple of years ago, because of someone having a similar issue to me, but in your fail2ban dovecot.iredmail rule, you have included the line that was removed.

if you check through the following issue and pull from github, you can see the problem in more detail:
https://github.com/fail2ban/fail2ban/issues/611
https://github.com/fail2ban/fail2ban/pull/601

"Removed the -no auth attemps- from the triggers because of lots of false positives"

In the fail2ban version of the filter.d/dovecot.conf this has been removed, but in the filter.d/dovecot.iredmail.conf this line has been included. Removing this line from the file has solved my issue.

Not sure what your thoughts on this are?

4

Re: Fail2ban blocking user

OK, removed in the latest development edition. Thanks for the feedback.