Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have some relay attempts like these in my mail.log (they total 281 connection attempts in less than 3 minutes):

May 16 04:58:30 MyServer postfix/smtpd[18950]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:30 MyServer postfix/smtpd[18951]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:30 MyServer postfix/smtpd[18951]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:31 MyServer postfix/smtpd[18947]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:31 MyServer postfix/smtpd[18952]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:31 MyServer postfix/smtpd[18952]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:31 MyServer postfix/smtpd[18947]: disconnect from unknown[xx.yy.zzz.www]
May 16 04:58:32 MyServer postfix/smtpd[18922]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:32 MyServer postfix/smtpd[18947]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:32 MyServer postfix/smtpd[18947]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:33 MyServer postfix/smtpd[18953]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:33 MyServer postfix/smtpd[18953]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:33 MyServer postfix/smtpd[18922]: disconnect from unknown[xx.yy.zzz.www]
May 16 04:58:33 MyServer postfix/smtpd[18948]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:33 MyServer postfix/smtpd[18949]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:33 MyServer postfix/smtpd[18922]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:33 MyServer postfix/smtpd[18922]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:34 MyServer postfix/smtpd[18948]: disconnect from unknown[xx.yy.zzz.www]
May 16 04:58:34 MyServer postfix/smtpd[18949]: disconnect from unknown[xx.yy.zzz.www]
May 16 04:58:34 MyServer postfix/smtpd[18948]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:34 MyServer postfix/smtpd[18948]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:34 MyServer postfix/smtpd[18949]: warning: xx.yy.zzz.www: hostname xx-yy-zzz-www.network.domain verification failed: No address associated with hostname
May 16 04:58:34 MyServer postfix/smtpd[18949]: connect from unknown[xx.yy.zzz.www]
May 16 04:58:35 MyServer postfix/smtpd[18950]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:35 MyServer postfix/smtpd[18951]: warning: unknown[xx.yy.zzz.www]: SASL LOGIN authentication failed: authentication failure
May 16 04:58:35 MyServer postfix/smtpd[18950]: disconnect from unknown[xx.yy.zzz.www]

I guess filter sasl (which is enabled) should take care of them, but ip is never banned. Seems there's no match with the failregex expression in sasl.conf filter:

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 728 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex = 

Any hint on what's failing here? Any way to correct the problem?

Edit: A simpler question that could be a start for troubleshooting this issue: do those SASL LOGIN warnings in mail.log match the failregex expression? I don't really know how to test it, and I don't have enough knowledge about regex sintax to work it out on my own.

Thanks in advance.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The last part of the regex does not match "authentication failure"

The failing part of the regex seems to match a base64 string:

(: [A-Za-z0-9+/]*={0,2})?*={0,2})?

Since "authentication failure" should definitely be blocked, I suggest replacing that part of the regex with:

(: ([A-Za-z0-9+/]*={0,2})?*={0,2})|authentication failure)?

This is an addition to the old rule, and would match : authentication failure.

share|improve this answer
    
Even though I don't really know what a base64 string is :) I'll try what you suggest and tell you how it's gone... –  luri Jun 4 '11 at 21:56
    
I made suggested changes. I haven't had another SASL login failure, so I don't really know if it does work... But I'll trust you. So I mark this as accepted answer, and it will remain as such for now. Thanks for the help. –  luri Jun 13 '11 at 10:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.