Changes

Brute Force Dictionary Attack on Dovecot

772 bytes added, 03:23, 8 February 2014
/* monitoring */
The following lines were added (+) and removed (-):
Lastly, a most useful feature of fail2ban is the ability to send you reports by email.  You can configure fail2ban to send you email notifications when it bans a host.Lastly, a most useful feature of fail2ban is the ability to send you reports by email.  You can configure fail2ban to send you email notifications when it bans a host. By default fail2ban is configured not to send any mails. You will have to make modifications to enable it.  Edit jail.local to set up email notifications.  Email notification is sent as an "action" and in the case of notifications for these smpt auth attacks, is under the label [sasl-iptables]Using action.d/mail.conf to email you a notification on common activities such as: fail2ban service start, banning and unbanning an address.    vi ./fail2ban/jail.localFind the line in the enabled action.  An action can have multiple lines.  Add a line under action =  mail[name=postfix-sasl, dest=yourmailbox, sender=fail2ban@localhost, sendername="Fail2Ban SASL"]In this example, actions adding iptables rules for smtp attack will result in an email sent to yourmailbox.
Bureaucrat, administrator
16,192
edits