1. 設定白名單(local IP)
sudo -u zimbra -
zmprov mcf +zimbraMailTrustedIP 127.0.0.1 +zimbraMailTrustedIP {IP of Server}
zmcontrol restart
2. 安裝 fail2ban
apt-get update
apt-get install fail2ban -y
3. 設定f2b白名單
#nano /etc/fail2ban/jail.local
代碼: 選擇全部
[DEFAULT]
# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts.
# Fail2ban will not ban a host which matches an address in this list.
# Several addresses can be defined using space (and/or comma) separator.
#ignoreip = 127.0.0.1/8 ::1 10.137.26.29/32
ignoreip = 127.0.0.1/8 IP-ADDRESS-OF-ZIMBRA-SERVER/32
banaction = route# nano /etc/fail2ban/jail.d/zimbra.local
代碼: 選擇全部
[zimbra-smtp]
enabled = true
filter = zimbra-smtp
port = 25,465,587
logpath = /var/log/zimbra.log
maxretry = 3
findtime = 86400
bantime = 86400
action = route
[zimbra-web]
enabled = true
filter = zimbra-web
port = 80,443,7071,9071
logpath = /opt/zimbra/log/mailbox.log
maxretry = 5
findtime = 86400
bantime = 86400
action = routenano /etc/fail2ban/filter.d/zimbra-web.conf
代碼: 選擇全部
[Definition]
failregex = .*ip=<HOST>;.*authentication failed for .*$
ignoreregex =代碼: 選擇全部
[Definition]
failregex = postfix\/submission\/smtpd\[\d+\]: warning: .*\[<HOST>\]: SASL \w+ authentication failed: authentication failure$
postfix\/smtps\/smtpd\[\d+\]: warning: .*\[<HOST>\]: SASL \w+ authentication failed: authentication failure$
ignoreregex =fail2ban-regex /var/log/zimbra.log /etc/fail2ban/filter.d/zimbra-smtp.conf
7. 重啟服務
systemctl restart fail2ban
systemctl status fail2ban
systemctl enable fail2ban
8. 確認服務狀態
fail2ban-client status
9. 檢查被BAN的IP
ip r
10 手動解除被Ban的IP
fail2ban-client set "Jail-Name" unbanip "Banned IP-Address"