Home / server / Questions / 737575
Accepted
Frank Barcenas
Asked: 2015-11-20 07:53:54 +0800 CST

fail2ban BANTIME not working for SASL

  • 772

My fail2ban bantime does not appear to be working. I still get repeated ban notifications from the same IP within 45 minutes of each other. My bantime is set to 24 hours.

[sasl]
enabled  = true
port     = smtp
filter   = sasl
action = iptables-multiport[name=sasl, port="smtp,ssmtp", protocol=tcp]
    sendmail-whois-lines[name=SASL, [email protected],[email protected], logpath=/var/log/mail.log]
    complain[logpath=/var/log/mail.log]
logpath  = /var/log/mail.log
maxretry = 3
findtime = 10800 # 3 hours
bantime  = 86400 # 24h

This is in /etc/fail2ban/jail.local

fail2ban

1 Answers

  1. Best Answer

    Discovered fail2ban does not like in-line comments.

    changed to:

    # 3 hours
findtime = 10800
# 24 hrs
bantime  = 86400

    and it all began to work correctly.

    • 4