无法将 sendmail "Connection rate limit exceeded" 与 fail2ban 匹配

Question

我无法找到阻止 fail2ban 匹配这些行的错误：

Apr 19 20:17:12 localhost sm-mta[201892]: ruleset=check_relay, arg1=[12.345.7.789], arg2=12.345.7.789, relay=host.hostname.com [12.345.7.789] (may be forged), reject=421 4.3.2 Connection rate limit exceeded.
Apr 19 20:17:53 localhost sm-mta[201902]: 13JIHpTD201902: [12.345.7.789] did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA-v4

这是相关的 fail2ban 配置：

[Definition]

_daemon = (?:(sm-(mta|acceptingconnections)|sendmail))
__prefix_line = %(known/__prefix_line)s(?:\w{14,20}: )?

prefregex = ^<F-MLFID>%(__prefix_line)s</F-MLFID><F-CONTENT>.+</F-CONTENT>$

cmnfailre = ^ruleset=check_relay, arg1=(?P<dom>\S+), arg2=(?:IPv6:<IP6>|<IP4>), relay=((?P=dom) )?\[(\d+\.){3}\d+\](?: \(may be forged\))?, reject=421 4\.3\.2 (Connection rate limit exceeded\.|Too many open connections\.)$
            ^(?:\S+ )?\[(?:IPv6:<IP6>|<IP4>)\](?: \(may be forged\))? did not issue (?:[A-Z]{4}[/ ]?)+during connection to (?:TLS)?M(?:TA|S[PA])(?:-\w+)?$

我正在用 fail2ban-regex test-mail.log /etc/fail2ban/filter.d/sendmail-reject.conf

进行测试

导致：

Results
=======

Failregex: 0 total

Ignoreregex: 0 total

Date template hits:
|- [# of hits] date format
|  [5] {^LN-BEG}(?:DAY )?MON Day %k:Minute:Second(?:\.Microseconds)?(?: ExYear)?
`-

Lines: 5 lines, 0 ignored, 0 matched, 5 missed
[processed in 0.00 sec]

有什么想法吗？

谢谢！

Answer 1

第二条消息 (did not issue MAIL/EXPN/VRFY/ETRN) 如果您通过 sendmail-reject jail 设置模式 aggressive 可以找到第二条消息 (did not issue MAIL/EXPN/VRFY/ETRN)（在此 fix 之后，例如 v.0.10.6 和 0.11 .2).

由于对参数的不同处理，第一条消息（rate limit exceeded）确实没有完全匹配这种消息的确切规则，但是...
我现在在 github 的 f0214b3 中解决了这个问题。

除非未发布，否则您可以在过滤器中自行扩展（从 github filter 复制粘贴）或直接在监狱中扩展：

[sendmail-reject]
enabled = true
mode = aggressive 
failregex = %(known/failregex)s
            ^ruleset=check_relay(?:, arg\d+=\S*)*, relay=(\S+ )?\[?<ADDR>\]?(?: \(may be forged\))?, reject=421 4\.3\.2 (Connection rate limit exceeded\.|Too many open connections\.)$"
            ^(?:\S+ )?\[<ADDR>\](?: \(may be forged\))? did not issue \S+ during connection

无法将 sendmail "Connection rate limit exceeded" 与 fail2ban 匹配

Unable to match sendmail "Connection rate limit exceeded" with fail2ban

fail2ban