TonyG's questions

Some messages in the fail2ban.log file are set to INFO, where I'd prefer them to be at DEBUG. I don't want some common detail in the logs. For example:

fail2ban.filter  [214912]: INFO [dovecot] Ignore 127.0.0.1 by ignoreself rule

Then there are messages that might be worth elevating from INFO to a level above, not quite WARNING, but more like FYI. Example:

[postfix] Found 1.2.3.4

Primary question: Where can we find information about how to manipulate the log level associated with a rule?

To be clear, I'm not asking about setting the logging level in /etc/fail2ban/fail2ban.local. That is a comparison value, and any log detail set at or above that value gets saved to the Fail2Ban log(s). I'm looking for the rule/filter value that the config value is compared to.

Related/secondary:

• Where is the code that assigns the log level to specific rules?
• Can we create more log levels?
• I understand that "ignoreself" is built-in. Is it a legitimate change to lower ignoreself messages down to DEBUG-level logging?

Thanks.

I'm running Ubuntu 20 and have installed Pure-FTPd. When I SFTP on port 22 with FileZilla the log shows "We claim SSH-2.0 FileZilla ... Remote version SSH-2.0 OpenSSH..." On login with FileZilla, auth.log shows an ssh2 connection.

I'm confused about why I don't see something like "Welcome to Pure-FTPd [privsep] [TLS]". The service is running. I haven't read anywhere that we need to do anything to tell OpenSSH to hand over SFTP requests to another process. I'm guessing that something else needs to be set under /etc/ssh/sshd_config.d ?

It doesn't look like the PureFTPd service is processing these requests at all, with its own user db or other settings.

Thanks.

A client has been using IIS v6 SMTP over Windows 2008 R2 for many years to send out automated server notifications. Their apps use Blat to send through localhost with no authentication. Email seems to go out directly from that system with a masquerade FQDN that is the same as their actual email server. Only their staff email (Outlook, etc) goes through the real SMTP server.

We're migrating most functionality to a new Windows 2016 server and I need to ensure all email automation is working correctly. I'm concerned that remote servers that check SPF or DKIM or other certification will either bounce or silently trash emails from this server. I believe the number of remote servers doing this is quite likely to increase over time.

But I have not found what I expected to be an outcry from admins about issues like this, only the occasional old questions about how to relay to GMail or some other server. I do not see a folder full of bounces. And I get emails from this server - unfiltered by my third-party email host.

So my fears don't seem to match with reality and I can't justify a recommendation to change the setup on their new system. That's fine, I don't have an agenda, I'm really looking to ensure that things just work, regardless of how it works.

1) Am I correct that recipient servers could/will/should be filtering these outbound notifications, and the intended recipients might not even be getting their emails?

2) Is it better to just use a "real" SMTP server like Exchange or Postfix?

3) Is there any downside to continue using Blat, with Basic Authentication into localhost, and continuing to use IIS SMTP to send email from their v2016 server?

Thanks!