Zimbra Collaboration Suite Open-Source ืึทืืืฉืึทื ืืื ืขืืืขืืข ืฉืืึทืจืง ืืืฉืืจืื ืฆื ืขื ืฉืืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืขืจืืืื. ืฆืืืืฉื ืืื - ืึท ืืืืืื ื ืคึฟืึทืจ ืคึผืจืึทืืขืงืืื ื ืึท ืคึผืึธืกื ืกืขืจืืืขืจ ืคืื ืื ืคืืื ืคืื ืืึธืื ืขืฅ, ClamAV - ืึทื ืึทื ืืืืืืจืืก ืืืึธืก ืงืขื ืขื ืืืขืจืงืืงื ืื ืงืึทืืื ื ืืขืงืขืก ืืื ืืืชืืืช ืคึฟืึทืจ ืื ืคืขืงืฆืืข ืืื ืืืืืข ืืืืื, ืืื ืืขืืื ื ืืื - ืืืื ืขืจ ืคืื ืื ืืขืกืืขืจ ืกืคึผืึทื ืคืืืืขืจืก ืืืึทื ื. ืึธืืขืจ, ืื ืืืฉืืจืื ืงืขื ืขื ื ืืฉื ืืึทืฉืืฆื Zimbra OSE ืคืื ืืจืื ืงืจืึทืคื ืื ืคืืื. ื ืื ืื ืืขืจืกื ืขืืขืืึทื ื, ืึธืืขืจ ื ืึธื ืืึทื ืฅ ืขืคืขืงืืืื, ืืจืื-ืคืึธืจืกืื ื ืคึผืึทืกืืืขืจืื ื ืืฆื ืึท ืกืคึผืขืฆืืขื ืืืขืจืืขืจืืื ืืื ืคืจืึธื ื ืื ืืืืื ืืื ืื ืืืงืขืืืืึธืึธื ืคืื ืืขืจืึธืื ืืึทืงืื ื ืืื ืึทืืข ืื ืงืึทื ืกืึทืงืืืขื ืกืึทื, ืึธืืขืจ ืืืื ืืื ืื ืฉืึทืคืื ื ืคืื ืึท ืืึทืืืืืืง ืืึทืกืข ืืืืฃ ืื ืกืขืจืืืขืจ, ืืืึธืก ืคึผืจืึทืกืขืกืึทื ืึทืืข. ื ืื ืืขืจืึธืื ืคืจืืืื ืฆื ืืึทืง ืึท ืกืขืจืืืขืจ ืืื Zimbra OSE.
ืืื ืคึผืจืื ืฆืืคึผ, ืืืจ ืงืขื ืขื ืืึทืฉืืฆื ืืื ืคืื ืืจืื ืงืจืึทืคื ื ืืฆื ื ืึธืจืืึทื Zimbra OSE ืืืฉืืจืื. ืื ืคึผืึทืจืึธื ืืืืขืจืืืื ืคึผืึธืืืืืง ืกืขืืืื ืืก ืืึธืื ืืืจ ืฆื ืฉืืขืื ืื ื ืืืขืจ ืคืื ื ืื ืืขืจืึธืื ืคึผืึทืจืึธื ืคึผืึธืืืฆืืข ืคืจืืืื, ื ืึธื ืืืึธืก ืื ืคึผืึทืืขื ืืฉืึทืื ืึทืืึทืงืืจื ืืฉืืื ืืื ืืคืืขืฉืืขืื. ืืขืจ ืืืืคึผื ืคึผืจืึธืืืขื ืืื ืืขื ืฆืืืึทื ื ืืื ืึทื ืกืืืืึทืืืึธื ืก ืืื ืืืึธืก ืื ืึทืงืึทืื ืฅ ืคืื ืืืื ืขืจ ืึธืืขืจ ืืขืจ ืขืืคึผืืืืื ืงืขื ืืืื ืืคืืขืฉืืขืื ืจืขืื ืฆื ืึท ืืจืื ืงืจืึทืคื ืืึทืคืึทืื ืฆื ืืืึธืก ืืื ืืึธืื ืืึธืจื ืืฉื ืฆื ืืึธื, ืืื ืื ืจืืืึทืืืื ื ืืึทืื ืืืื ืืื ืืขืจ ืึทืจืืขื ืคืื ืขืืคึผืืืืื ืงืขื ืขื ืืจืขื ืืขื ืืจืืืก ืืึธืกืกืขืก ืฆื ืื ืคืืจืืข. ืึทื ืืื ืืืึธืก ืขืก ืืื ืืขืกืืขืจ ื ืืฉื ืฆื ื ืืฆื ืืขื ืึธืคึผืฆืืข ืคืื โโืฉืืฅ ืงืขืื ืืจืื ืงืจืึทืคื.
ืฆื ืืึทืฉืืฆื ืงืขืื ืืจืื ืงืจืึทืคื, ืึท ืกืคึผืขืฆืืขื ืืขืฆืืึทื ืืขืจืืคื DoSFilter ืืื ืคืื ืืขืกืขืจ ืกืืืึทื, ืืืึธืก ืืื ืืขืืืื ืืื Zimbra OSE ืืื ืงืขื ืขื ืืืืืึธืืึทืืืฉ ืคืึทืจืขื ืืืงื ืื ืงืฉืจ ืฆื Zimbra OSE ืืืจื HTTP. ืืื ืื ืืขืจืข ืืืขืจืืขืจ, ืื ืึทืคึผืขืจืืืืื ื ืคึผืจืื ืฆืืคึผ ืคืื DoSFilter ืืื ืขื ืืขื ืฆื ืื ืึธืคึผืขืจืืืืื ื ืคึผืจืื ืฆืืคึผ ืคืื ืคึผืึธืกืืกืงืจืื, ื ืึธืจ ืขืก ืืื ืืขื ืืฆื ืคึฟืึทืจ ืึท ืึทื ืืขืจืฉ ืคึผืจืึธืืึธืงืึธื. ืึธืจืืืื ืึทืืื ืืืืืื ื ืฆื ืืึทืืจืขื ืขืฆื ืื ื ืืืขืจ ืคืื ืึทืงืฉืึทื ื ืึท ืืืื ืืึทื ืืฆืขืจ ืงืขื ืขื ืืืจืืคืืจื, DoSFilter ืงืขื ืขื ืืืื ืฆืืฉืืขืื ืืจืื ืงืจืึทืคื ืฉืืฅ. ืืืื ืฉืืืกื ืืืืืง ืคืื ืื ืืขืฆืืึทื ืืขืืืื ืืื ืืืืืจืึท ืืื ืึทื ื ืึธื ืึท ืืืืขืจ ื ืืืขืจ ืคืื ื ืื ืืขืจืึธืื ืคืจืืืื, ืขืก ืืืึทืงืก ื ืืฉื ืืขืจ ืืึทื ืืฆืขืจ ืืื, ืึธืืขืจ ืื IP ืึทืืจืขืก ืคืื ืืืึธืก ืงืืืคื ืคืจืืืื ืฆื ืึทืจืืึทื ืืึธืืืจื ืืื ืึท ืืึทืืื ืืขืจ ืืฉืืื. ืืึทื ืง ืฆื ืืขื, ืึท ืกืืกืืขื ืึทืืืื ืืกืืจืึทืืึธืจ ืงืขื ืขื ื ืื ืืืืื ืืึทืฉืืฆื ืงืขืื ืืจืื ืงืจืึทืคื, ืึธืืขืจ ืืืื ืืืกืืืืื ืืืึทืงืื ื ืคืืจืืข ืขืืคึผืืืืื ืืืจื ืคืฉืื ืึทืืื ื ืื ืื ืขืจืืขื ื ืขืฅ ืคืื ืืืื ืคืืจืืข ืฆื ืืขืจ ืจืฉืืื ืคืื ืืจืึทืกืืื IP ืึทืืจืขืกืขืก ืืื ืกืืื ืขืฅ.
ืื ืืจืืืก ืืืึทืืข ืคืื โโDoSFilter ืืื ืึทื ืืื ืึทืืืฉืึทื ืฆื ืคืืืข ืคืจืืืื ืฆื ืงืืึธืฅ ืืื ืึท ืืึทืืื ืืขืจ ืืฉืืื, ืืื ืืขื ืืขืฆืืึทื ืืืจ ืงืขื ืขื ืืืืืึธืืึทืืืฉ ืคืึทืจืฉืคึผืึทืจื ืื ืึทืืึทืงืขืจื ืืืึธืก ืืึธืื ืคืืจืืืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืื ืคืื ืึทื ืึธื ืืขืฉืืขืืืขืจ, ืืื ืืขืจื ืึธื ืืฆืืื ืืึธืื ืืื ืืืื ืืฉืืื ืืื ืื ืืขืืืืื ืฉืืงื ืืื ืืขืจืืขืจ ืคืื ืจืืงืืืขืก. ืฆื ืื ืกืขืจืืืขืจ.
ืืืจ ืงืขื ืขื ืงืึทื ืคืืืืขืจ DoSFilter ืืื ืื ืคืืืืขื ืืข ืงืึทื ืกืึธืื ืงืึทืืึทื ืื:
- zimbraHttpDosFilterMaxRequestsPerSec - ื ืืฆื ืืขื ืืึทืคึฟืขื, ืืืจ ืงืขื ืขื ืฉืืขืื ืื ืืึทืงืกืืืื ื ืืืขืจ ืคืื ืงืึทื ืขืงืฉืึทื ื ืขืจืืืืื ืคึฟืึทืจ ืืืื ืืึทื ืืฆืขืจ. ืืืจื ืคืขืืืงืืึทื ืืขื ืืืขืจื ืืื 30 ืงืึทื ืขืงืฉืึทื ื.
- zimbraHttpDosFilterDelayMillis - ื ืืฆื ืืขื ืืึทืคึฟืขื, ืืืจ ืงืขื ืขื ืฉืืขืื ืึท ืคืึทืจืืึทืืื ืืื ืืืืืกืขืงืึทื ืื ืคึฟืึทืจ ืงืึทื ืขืงืฉืึทื ื ืืืึธืก ืืืขื ืืงืกืื ืื ืฉืืขืืจ ืกืคึผืขืกืืคืืขื ืืืจื ืื ืคืจืืขืจืืืงืข ืืึทืคึฟืขื. ืืื ืึทืืืฉืึทื ืฆื ืื ืืึทืืืฉืขืจ ืืืึทืืืขืก, ืืขืจ ืึทืืืื ืืกืืจืึทืืึธืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื 0, ืึทืืื ืึทื ืขืก ืืื ืงืืื ืคืึทืจืืึทืืื ืืืึท ืึทืืข, ืืื -1, ืึทืืื ืึทื ืึทืืข ืงืึทื ืขืงืฉืึทื ื ืืืึธืก ืืงืกืื ืื ืกืคึผืขืกืืคืืขื ืฉืืขืืจ ืืขื ืขื ืคืฉืื ืื ืืขืจืึทืคึผืืื. ืื ืคืขืืืงืืึทื ืืืขืจื ืืื -1.
- zimbraHttpThrottleSafeIPs - ื ืืฆื ืืขื ืืึทืคึฟืขื, ืืขืจ ืึทืืืื ืืกืืจืึทืืึธืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืืจืึทืกืืื IP ืึทืืจืขืกืขืก ืืื ืกืืื ืขืฅ ืืืึธืก ืืืขื ื ืืฉื ืืืื ืืื ืืขืจืืขื ืืง ืฆื ืื ืจืืกืืจืืงืฉืึทื ื ืืืกืืขื ืืืืื. ืืึทืืขืจืงืื ื ืึทื ืื ืกืื ืืึทืงืก ืคืื ืืขื ืืึทืคึฟืขื ืงืขื ืืืึทืื ืืืคึผืขื ืืื ื ืืืืฃ ืื ืืขืืืืื ืจืขืืืืืึทื. ืึทืืื, ืคึฟืึทืจ ืืืึทืฉืคึผืื, ืืืจื ืึทืจืืึทื ืื ืืึทืคึฟืขื zmprov mcf zimbraHttpThrottleSafeIPs 127.0.0.1, ืืืจ ืืืขื ืืึธืจ ืึธืืืืขืจืจืืื ืื ืืื ืฆืข ืจืฉืืื ืืื ืืึธืื ืืืืื ืืืื IP ืึทืืจืขืก ืืื ืขืก. ืืืื ืืืจ ืึทืจืืึทื ืื ืืึทืคึฟืขื zmprov mcf + zimbraHttpThrottleSafeIPs 127.0.0.1, ืื IP ืึทืืจืขืก ืืืจ ืึทืจืืึทื ืืืขื ืืืื ืืืกืืฃ ืฆื ืื ืืืืึทืก ืจืฉืืื. ืกืืืืืึทืจืื, ืืื ืื ืืืกืขืจ ืฆืืืื, ืืืจ ืงืขื ืขื ืึทืจืึธืคึผื ืขืืขื ืงืืื IP ืคืื ืืขืจ ืขืจืืืืื ืจืฉืืื.
ืืืืข ืืึธื ืึทื DoSFilter ืงืขื ืืึทืื ืึท ื ืืืขืจ ืคืื ืคึผืจืึธืืืขืืก ืืืขื ืืืจ ื ืืฆื Zextras Suite Pro ืืงืกืืขื ืฉืึทื ื. ืืื ืกืืจ ืฆื ืืืกืืืืื ืืื, ืืืจ ืจืขืงืึธืืขื ืืืจื ืฆื ืคืึทืจืืจืขืกืขืจื ืื ื ืืืขืจ ืคืื ืกืืืืึทืืืืื ืืึทืก ืงืึทื ืขืงืฉืึทื ื ืคืื 30 ืฆื 100 ืืื ืืขื ืืึทืคึฟืขื. zmprov mcf zimbraHttpDosFilterMaxRequestsPerSec 100. ืืื ืึทืืืฉืึทื, ืืืจ ืจืขืงืึธืืขื ืืืจื ืฆื ืืืืื ืื ืื ืขืจืืขื ื ืขืฅ ืคืื ืื ืคืึทืจื ืขืืื ื ืฆื ืืขืจ ืจืฉืืื ืคืื ืขืจืืืืื. ืืขื ืงืขื ืขื ืืืื ืืขืืื ืืื ืืขื ืืึทืคึฟืขื zmprov mcf + zimbraHttpThrottleSafeIPs 192.168.0.0/24. ื ืึธื ืืึทืื ืงืืื ืขื ืืขืจืื ืืขื ืฆื DoSFilter, ืืืื ืืืืขืจ ืฆื ืจืืกืืึทืจื ืืืื ืคึผืึธืกื ืกืขืจืืืขืจ ื ืืฆื ืื ืืึทืคึฟืขื zmmailboxdctl ืจืืกืืึทืจื.
ืืขืจ ืืืืคึผื ืืืกืึธืจื ืคืื DoSFilter ืืื ืึทื ืขืก ืึทืจืืขื ืืืืฃ ืื ืึทืคึผืืึทืงืืืฉืึทื ืืืจืื ืืื ืงืขื ืืืืื ืืึทืืจืขื ืขืฆื ืื ืคืืืืงืืื ืคืื ืึทืืึทืงืขืจื ืฆื ืืืจืืคืืจื ืคืึทืจืฉืืื ืึทืงืฉืึทื ื ืืืืฃ ืื ืกืขืจืืืขืจ, ืึธื ืืึทืืจืขื ืขืฆื ืื ืคืืืืงืืื ืฆื ืคืึทืจืืื ืื ืฆื ืื ืฆืคืื. ืฆืืืื ืืขื, ืืืขืื ืื ืจืืงืืืขืก ืืขืฉืืงื ืฆื ืื ืกืขืจืืืขืจ ืคึฟืึทืจ ืึธืืขื ืืึทืงืืืฉืึทื ืึธืืขืจ ืฉืืงื ืืจืืื, ืืึธืืฉ ืืื ืืืขืื ืืึธื ืคืึทืจืืึธืื, ื ืึธื ืคืึธืจืฉืืขืื ืึท ืืื ืึทืื ืืึธืก ืืึทืคืึทืื, ืืืึธืก ืงืขื ืขื ื ืื ืืืื ืกืืึทืคึผื ืืืืฃ ืึทืืึท ืึท ืืืื ืืืจืื.
ืืื ืกืืจ ืฆื ืืึธืจ ืืึทืืืึธืจืขื ืขื ืืืื ืคึฟืืจืืข ืกืขืจืืืขืจ ืืื Zimbra OSE, ืืืจ ืงืขื ืขื ื ืืฆื ืึท ืืืืืื ื ืึทืืึท ืืื Fail2ban, ืืืึธืก ืืื ืึท ืคืจืืืืืืขืจืง ืืืึธืก ืงืขื ืขื ืงืขืกืืืืขืจ ืืึธื ืืืึธืจ ืืื ืคึฟืึธืจืืึทืฆืืข ืกืืกืืขื ืืึธืืก ืคึฟืึทืจ ืจืืคึผืืืื ืึทืงืฉืึทื ื ืืื ืคืึทืจืฉืคึผืึทืจื ืื ืื ืืจืืืขืจ ืืืจื ืืฉืึทื ืืื ื ืื ืคืืืจืืืึทื ืกืขืืืื ืืก. ืืืึทืงืื ื ืืืืฃ ืึทืืึท ืึท ื ืืืขืจืืง ืืืจืื ืึทืืึทืื ืืืจ ืฆื ืืืกืืืืึทื ืึทืืึทืงืขืจื ืจืขืื ืืื ืืขืจ ืืื ืข ืคืื โโIP ืงืฉืจ ืฆื ืื ืกืขืจืืืขืจ. ืืืื, Fail2Ban ืงืขื ืขื ืืืฉืืืืืขืก ืืขืจืืึทื ื ืื ืฉืืฅ ืืขืืืื ืืื ืืึธืกืคืืืืขืจ. ืืึธืืืจ ืืขืคึฟืื ืขื ืืืืก ืืื ืืืจ ืงืขื ืขื ืคืึทืจืืื ืื Fail2Ban ืืื Zimbra OSE ืืื ืืขืจืืื ืคืึทืจืืจืขืกืขืจื ืื ืืืืขืจืืืื ืคืื ืื IT ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืคืื ืืืื ืคืึทืจื ืขืืื ื.
ืืื ืงืืื ืื ืืขืจืข ืคืึทืจื ืขืืื ื ืงืืึทืก ืึทืคึผืืึทืงืืืฉืึทื, Zimbra Collaboration Suite Open-Source ืึทืืืฉืึทื ืืืื ืืืืืืื ืืึธืืก ืคืื ืืืื ืึทืจืืขื. ืจืืึฟ ืคืื ืืื ืืขื ืขื ืกืืึธืจื ืืื ืืขืจ ืืขืงืข /opt/zimbra/log/ ืืื ืื ืคืึธืจืขื ืคืื ืืขืงืขืก. ืืึธ ืืขื ืขื ื ืึธืจ ืึท ืืืกื ืคืื ืืื:
- mailbox.log - ืืืฉืขืื ืคึผืึธืกื ืกืขืจืืืืก ืืึธืืก
- audit.log - ืึธืืขื ืืึทืงืืืฉืึทื ืืึธืืก
- clamd.log - ืึทื ืืืืืืจืืก ืึธืคึผืขืจืึทืฆืืข ืืึธืืก
- freshclam.log - ืึทื ืืืืืืจืืก ืืขืจืืืึทื ืืืงื ืืึธืืก
- convertd.log - ืึทืืึทืืฉืืึทื ื ืงืึทื ืืืขืจืืขืจ ืืึธืืก
- zimbrastats.csv - ืกืขืจืืืขืจ ืคืึธืจืฉืืขืืื ื ืืึธืืก
Zimbra ืืึธืืก ืงืขื ืขื ืืืื ืืืื ืืขืคึฟืื ืขื ืืื ืืขืจ ืืขืงืข /var/log/zimbra.log, ื ืฐ ืข ื ืฐืขืจ ื ืืขืืืื ื ืืื ื ืคื ื ืคืืกืืคืืง ืก ืื ื ืืืืืจื .
ืืื ืกืืจ ืฆื ืืึทืฉืืฆื ืืื ืืืขืจ ืกืืกืืขื ืคืื ืืจืื ืงืจืึทืคื, ืืืจ ืืืขืื ืืึธื ืืืึธืจ mailbox.log, ืงืึธื ืืจืึธืืืจื.ืืึธื ะธ zimbra.log.
ืึผืื ืึทืืฅ ืืึธื ืึทืจืืขืื, ืขืก ืืื ื ืืืืืง ืึทื Fail2Ban ืืื iptables ืืขื ืขื ืืื ืกืืึทืืืจื ืืืืฃ ืืืื ืกืขืจืืืขืจ ืืื Zimbra OSE. ืืืื ืืืจ ื ืืฆื ืืืื ืื, ืืืจ ืงืขื ืขื ืืึธื ืืึธืก ืืื ืื ืงืึทืืึทื ืื dpkg -s fail2ban, ืืืื ืืืจ ื ืืฆื CentOS, ืืืจ ืงืขื ืขื ืงืึธื ืืจืึธืืืจื ืืขื ืืื ืื ืงืึทืืึทื ืื ืืึทื ืจืฉืืื ืืื ืกืืึทืืืจื fail2ban. ืืืื ืืืจ ืืึธื ื ืื ืืึธืื Fail2Ban ืืื ืกืืึทืืืจื, ืื ืกืืึธืืื ื ืขืก ืืืขื ื ืืฉื ืืืื ืึท ืคึผืจืึธืืืขื, ืืืืึทื ืืขื ืคึผืขืงื ืืื ืื ืืืฆื ืืื ืึผืืขื ืึทืืข ื ืึธืจืืึทื ืจืืคึผืึทืืึทืืึธืจืื.
ืึทืืึธื ืึทืืข ืื ื ืืืืืง ืืืืืืืืืจื ืืื ืืื ืกืืึทืืืจื, ืืืจ ืงืขื ืขื ืึธื ืืืืื ืืึทืฉืืขืืืงื Fail2Ban. ืฆื ืืึธื ืืึธืก, ืืืจ ืืึทืจืคึฟื ืฆื ืฉืึทืคึฟื ืึท ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข /etc/fail2ban/filter.d/zimbra.conf, ืืื ืืืึธืก ืืืจ ืืืขืื ืฉืจืืึทืื ืจืขืืืืขืจ ืืืืกืืจืืงื ืคึฟืึทืจ Zimbra OSE ืืึธืืก ืืืึธืก ืืืขื ืืืืึทืื ืคืึทืืฉ ืืึธืืื ืคืจืืืื ืืื ืฆืื ืื Fail2Ban ืืขืงืึทื ืืืึทืื. ืืึธ ืืื ืึท ืืืืฉืคึผืื ืคืื ืื ืืื ืืึทืื ืคืื zimbra.conf ืืื ืึท ืืึทื ื ืคืื ืจืขืืืืขืจ ืืืืกืืจืืงื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืฆื ืื ืคืึทืจืฉืืื ืขืจืจืึธืจืก ืึทื Zimbra OSE ืืืืจืคื ืขืจ ืืืขื ืึทื ืึธืืขื ืืึทืงืืืฉืึทื ืคึผืจืืืื ืคืืืื:
# Fail2Ban configuration file
[Definition]
failregex = [ip=<HOST>;] account - authentication failed for .* (no such account)$
[ip=<HOST>;] security - cmd=Auth; .* error=authentication failed for .*, invalid password;$
;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$
;oip=<HOST>;.* security - cmd=Auth; .* protocol=imap; error=authentication failed for .* invalid password;$
[oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found$
WARN .*;ip=<HOST>;ua=ZimbraWebClient .* security - cmd=AdminAuth; .* error=authentication failed for .*;$
ignoreregex =ืึทืืึธื ืื ืจืขืืืืขืจ ืืืืกืืจืืงื ืคึฟืึทืจ Zimbra OSE ืืขื ืขื ืฆืื ืืืคืืขืฉืืขืื, ืขืก ืืื ืฆืืื ืฆื ืึธื ืืืืื ืจืขืืึทืืืจื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื Fail2ban ืืื. ืื ืกืขืืืื ืืก ืคืื ืืขื ื ืืฆื ืืขื ืขื ืืืื ืืื ืืขืจ ืืขืงืข /etc/fail2ban/jail.conf. ื ืึธืจ ืืื ืคืึทื, ืืึธืื ืืื ืื ืืึทืื ืึท ืืึทืงืึทืคึผ ืงืึธืคึผืืข ืคืื โโโโืขืก ื ืืฆื ืื ืืึทืคึฟืขื cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.conf.bak. ื ืึธื ืืขื, ืืืจ ืืืขืื ืจืขืืืฆืืจื ืื ืืขืงืข ืฆื ืืขืขืจืขื ืื ืคืืืืขื ืืข ืคืึธืจืขื:
# Fail2Ban configuration file
[DEFAULT]
ignoreip = 192.168.0.1/24
bantime = 600
findtime = 600
maxretry = 5
backend = auto
[ssh-iptables]
enabled = false
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
sendmail-whois[name=SSH, [email protected], [email protected]]
logpath = /var/log/messages
maxretry = 5
[sasl-iptables]
enabled = false
filter = sasl
backend = polling
action = iptables[name=sasl, port=smtp, protocol=tcp]
sendmail-whois[name=sasl, [email protected]]
logpath = /var/log/zimbra.log
[ssh-tcpwrapper]
enabled = false
filter = sshd
action = hostsdeny
sendmail-whois[name=SSH, dest=support@ company.ru]
ignoreregex = for myuser from
logpath = /var/log/messages
[zimbra-account]
enabled = true
filter = zimbra
action = iptables-allports[name=zimbra-account]
sendmail[name=zimbra-account, [email protected] ]
logpath = /opt/zimbra/log/mailbox.log
bantime = 600
maxretry = 5
[zimbra-audit]
enabled = true
filter = zimbra
action = iptables-allports[name=zimbra-audit]
sendmail[name=Zimbra-audit, [email protected]]
logpath = /opt/zimbra/log/audit.log
bantime = 600
maxretry = 5
[zimbra-recipient]
enabled = true
filter = zimbra
action = iptables-allports[name=zimbra-recipient]
sendmail[name=Zimbra-recipient, [email protected]]
logpath = /var/log/zimbra.log
bantime = 172800
maxretry = 5
[postfix]
enabled = true
filter = postfix
action = iptables-multiport[name=postfix, port=smtp, protocol=tcp]
sendmail-buffered[name=Postfix, [email protected]]
logpath = /var/log/zimbra.log
bantime = -1
maxretry = 5ืืึธืืฉ ืืึธืก ืืืืฉืคึผืื ืืื ืืึทื ืฅ ืืืฉืึทื ืขืจืืง, ืขืก ืืื ื ืึธื ืืืขืจื ืฆื ืืขืจืงืืขืจื ืขืืืขืืข ืคืื โโืื ืคึผืึทืจืึทืืขืืขืจืก ืืืึธืก ืืืจ ืงืขื ืืืขืื ืฆื ืืืืฉื ืืืขื ืืืจ ืฉืืขืื ืืื Fail2Ban ืืื:
- ืืืื ืึธืจืืจื - ื ืืฆื ืืขื ืคึผืึทืจืึทืืขืืขืจ ืืืจ ืงืขื ืขื ืกืคึผืขืฆืืคืืฆืืจื ืึท ืกืคึผืขืฆืืคืืฉ ืืคึผ ืึธืืขืจ ืกืืื ืขื ืคึฟืื ืืืึธืก Fail2Ban ืืึธื ื ืืฉื ืงืึธื ืืจืึธืืืจื ืึทืืจืขืกืขืก. ืืื ืึท ืืขืจืฉื, ืื ืื ืขืจืืขื ื ืขืฅ ืคืื ืื ืคืึทืจื ืขืืื ื ืืื ืื ืืขืจืข ืืจืึทืกืืื ืึทืืจืขืกืขืก ืืขื ืขื ืืืกืืฃ ืฆื ืืขืจ ืจืฉืืื ืคืื ืืืื ืึธืจืืจื ืึธื ืขืก.
- ืืึทื ืืืืข โ ื ื ืฆืฒื , ืฐื ืก ืืข ืจ ืคืืจืืจืขืืขืจ , ืฐืข ื ืคืืจืืื ื ืฐืขืจื . ืืขืืืกืื ืืื ืกืขืงืื ืืขืก. ื ืืืขืจื ืคืื -1 ืืืื ืึท ืฉืืขื ืืืง ืคืึทืจืืึธื.
- ืืึทืงืกืจืขืืจื - ืื ืืึทืงืกืืืื ื ืืืขืจ ืคืื ืืึธื ืืืื IP ืึทืืจืขืก ืงืขื ืขื ืคึผืจืืืืจื ืฆื ืึทืงืกืขืก ืื ืกืขืจืืืขืจ.
- ืกืขื ืืืึทืื - ื ืืึทืฉืืขืืืงื ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืืืืืึธืืึทืืืฉ ืฉืืงื ืืืืฆืคึผืึธืกื ื ืึธืืืึทืคืึทืงืืืฉืึทื ื ืืืขื Fail2Ban ืืื ืืจืืืขืจื.
- Findtime - ื ืืึทืฉืืขืืืงื ืืืึธืก ืึทืืึทืื ืืืจ ืฆื ืฉืืขืื ืื ืฆืืื ืืขืืึทืืขื ื ืึธื ืืืึธืก ืื IP ืึทืืจืขืก ืงืขื ืขื ืคึผืจืืืืจื ืฆื ืึทืงืกืขืก ืื ืกืขืจืืืขืจ ืืืืืขืจ ื ืึธื ืื ืืึทืงืกืืืื ื ืืืขืจ ืคืื ื ืื ืืขืจืึธืื ืคืจืืืื ืืื ืืืกืืขืืึทืืขืจื (ืืึทืงืกืจืขืืจื ืคึผืึทืจืึทืืขืืขืจ)
ื ืึธื ืฉืคึผืึธืจื ืื ืืขืงืข ืืื ืื Fail2Ban ืกืขืืืื ืืก, ืึทืืข ืืืึธืก ืืืืืื ืืื ืฆื ืจืืกืืึทืจื ืืขื ื ืืฆื ืืื ืื ืืึทืคึฟืขื. ืกืขืจืืืืก fail2ban ืจืืกืืึทืจื. ื ืึธื ืื ืจืืกืืึทืจื, ืื ืืืืคึผื ืืืืืจืึท ืืึธืืก ืืืขื ืึธื ืืืืื ืงืขืกืืืืขืจ ืืึธื ืืืึธืจืขื ืคึฟืึทืจ ืืขืกืงืขื ืืื ืจืขืืืืขืจ ืืืืกืืจืืงื. ืืึทื ืง ืฆื ืืขื, ืืขืจ ืึทืืืื ืืกืืจืึทืืึธืจ ืืืขื ืืืื ืืืืืืช ืฆื ืืืขื ืขืืืืื ืืจื ืงืืื ืืขืืืขืืงืืื ืคืื ืึท ืึทืืึทืงืขืจ ืืืจืื ืขืืขื ื ืื ืืืืื Zimbra Collaboration Suite Open-Source ืึทืืืฉืึทื ืืจืืืืงืึทืกืื, ืึธืืขืจ ืืืื ืืึทืฉืืฆื ืึทืืข ืกืขืจืืืืกืขืก ืคืืืกื ืืืง ืืื Zimbra OSE, ืืื ืืืื ืืืื ืึทืืืขืจ ืคืื ืงืืื ืคืจืืืื ืฆื ืืึทืงืืืขื ืึทื ืึธืืขืจืืืื ืึทืงืกืขืก. .
ืคึฟืึทืจ ืึทืืข ืคึฟืจืืื ืฉืืึทืืืช ืฆื Zextras Suite, ืืืจ ืงืขื ื ืงืึธื ืืึทืงื Zextras ืคืืจืฉืืืืขืจ Ekaterina Triandafilidi ืืืจื E- ืืจืืื [ืืืืขืื ืืืฉืืฆื]
ืืงืืจ: www.habr.com