jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix dovecot low-and-slow fail2ban gap; generalize findtime guidance

Browse Source 
Same evasion pattern already fixed for sshd recurred against dovecot: a
coordinated IMAP password spray paced just outside the 30-minute findtime
window ran unbanned for days. Widened dovecot's findtime the same way,
and updated SETUP.md so future provisioning applies this to every
credential jail up front instead of waiting for it to reappear.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jens
2026-07-25 21:47:33 +02:00
co-authored by Claude Sonnet 5
parent 3f51d6016e
commit 04fff20577
2 changed files with 57 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+22
View File
@@ -236,3 +236,25 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
rather than editing the Debian-packaged jail file. Applied via
`fail2ban-client reload sshd`; `47.76.192.176` was banned on its very
next attempt after the change.
- [x] **fail2ban: `dovecot` jail had the same low-and-slow gap as `sshd`** — done 2026-07-25
found while auditing which IPs were hitting webmail hard enough to
deserve a ban but weren't in any currently-banned list. Same default
`findtime=30m`/`maxretry=3` as `sshd`'s pre-fix config. At least 4 IPs
(`47.95.196.60` 167 hits, `82.157.132.42` 144, `120.48.118.132` 76,
`188.164.195.116` 57, `157.245.38.26` 34) ran a coordinated IMAP
password spray against generic mailbox names (`admin@`, `test@`,
`support@`, `sales@jayfield.org`) starting almost simultaneously around
2026-07-21 22:40-23:38, each pacing itself at ~1 attempt/22-25min —
just outside the 30-minute window, so none ever tripped 3 strikes.
`120.48.118.132` was still active as late as 2026-07-25 13:32, so the
campaign was ongoing, not historical. `postfix-sasl` shares the same
default thresholds and mail stack but showed much lower per-IP volume
in this pass — worth a follow-up check if it starts trending the same
way.
Fixed: `/etc/fail2ban/jail.d/dovecot-findtime.local`, same values as
the `sshd` fix (`findtime=1d`, `maxretry=4`, `bantime=1d`). Applied via
`fail2ban-client reload dovecot`; verified live with
`fail2ban-client get dovecot findtime/maxretry/bantime` and confirmed
the jail's existing ban state (`47.88.56.201`, 29 total bans) survived
the reload.