Exim | Записки системного администратора

Записи с меткой ‘Exim’

Мониторинг Exim в Zabbix

Июнь 1st, 2016

Evgeniy Kamenev

1.Настройка скрипта для анализа Exim-логов на Zabbix-агенте

# nano /etc/zabbix/scripts/exim4.sh

1	# nano /etc/zabbix/scripts/exim4.sh

#!/bin/bash
# Egor Minko. Synchron LLC. May.2012

zexim4ver="ver 2.1"
rval=0

# MULTIPLE PARSERS PROTECTION
LOCK=/tmp/zexim4.pid
while [ -e "$LOCK" ]; do
PID="`cat $LOCK`"
while [ "`ps h -p $PID -o pid,comm|wc -l`" -gt 0 ]
do
sleep 0.$[ ( $RANDOM % 10 ) + 1 ]s
done
done
echo $$ > $LOCK
trap "rm -f $LOCK; exit" INT TERM EXIT


# USAGE
function usage()
{
echo "zexim version: $zexim4ver"
echo "usage:"
echo " $0 deliver -- Delivered Messages"
echo " $0 arrive -- Submited Pakets"
echo " $0 error -- Errors Total for Messages"
echo " $0 defer -- Error status: Defered Messages"
echo " $0 unroute -- Error status: Unroutable address"
echo " $0 local -- Local/Virtual delivery of Messages"
echo " $0 complete -- Finished Packets"
echo " $0 reject -- Rejects Total for Packets"
echo " $0 badrelay -- Reject status: Relay not permited"
echo " $0 Pqueue -- Queue size in Packets"
echo " $0 Mqueue -- Queue size in Messages"
echo " $0 frozen -- Frozen Packets"
echo ""
echo " Packet = letter with many recipients"
echo " Message = A single message for one recipient"
echo ""
}

# GLOBAL INSTRUCTIONS
CACHETTL="58" # sec
main_log=/var/log/exim_mainlog
tmp_log=/tmp/exim_log_pars.txt
stats=/tmp/stats.txt
exim=`which exim`
function create_data()
{
# CREATING STATS FILE
if [ ! -e "$stats" ] ; then touch $stats ; fi

# CREATING TMP FILE
# additional 'sub' in 'awk' used for cutting special chars that breaks next 'sed' parsing. For now: []()
position=`tail -1 $stats |awk '{print $1" "$2" "$3}'`
position_log=`tail -1 $main_log | awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print $1" "$2" "$3}'`

# BUILDING REPORT ONLY IF THERE IS DIFFERENCE BETWEEN LAST LINE IN LOG
if [ "$position" == "$position_log" ]
then
vars="0 0 0 0 0 0 0 0 0"
else
if ! grep -qc "" $stats || ! awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log|grep -qc "$position"
then
awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log $main_log > $tmp_log
else
awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log |sed 1,/"$position"/d | sed /"$position"/d > $tmp_log
fi
vars="`awk '\
BEGIN {deliver=0; arrive=0; error=0; local=0; complete=0; reject=0; badrelay=0; defer=0; unroute=0}\
/[-=]>/ { deliver++ }\
/<=/ {arrive++}\
/ \*\* / {error++}\
/[=][=]/ {defer++}\
/al_delivery/ {local++}\
/Completed/ {complete++}\
/rejected/ {reject++}\
/relay not permitted/ {badrelay++}\
/Unrouteable address/ {unroute++}\
END {print deliver" "arrive" "error" "defer" "local" "complete" "reject" "badrelay" "unroute}' $tmp_log`"
fi

queue_size="`$exim -bpc`"
recipients="`exipick -bpu |awk '$2==""{print $1}'|grep -vE "^$"|wc -l`"
frozen="`exiqgrep -zi|wc -l`"
echo $position_log $vars $queue_size $recipients $frozen >> $stats

}
function zabbix_answer()
{
case $CASE_VALUE in
'deliver')
tail -n1 "$stats"|awk '{print $4}'
rval=$?;;
'arrive')
tail -n1 "$stats"|awk '{print $5}'
rval=$?;;
'error')
tail -n1 "$stats"|awk '{print $6}'
rval=$?;;
'defer')
tail -n1 "$stats"|awk '{print $7}'
rval=$?;;
'local')
tail -n1 "$stats"|awk '{print $8}'
rval=$?;;
'complete')
tail -n1 "$stats"|awk '{print $9}'
rval=$?;;
'reject')
tail -n1 "$stats"|awk '{print $10}'
rval=$?;;
'badrelay')
tail -n1 "$stats"|awk '{print $11}'
rval=$?;;
'unroute')
tail -n1 "$stats"|awk '{print $12}'
rval=$?;;
'Pqueue')
tail -n1 "$stats"|awk '{print $13}'
rval=$?;;
'Mqueue')
tail -n1 "$stats"|awk '{print $14}'
rval=$?;;
'frozen')
tail -n1 "$stats"|awk '{print $15}'
rval=$?;;
'version')
echo "$zexim4ver"
rm $LOCK
trap - INT TERM EXIT
exit $rval;;
*)
usage
rm $LOCK
trap - INT TERM EXIT
exit $rval;;
esac
}
if [ -s "$stats" ]; then
TIMECACHE=`stat -c"%Z" "$stats"`
else
TIMECACHE=0
fi


TIMENOW=`date '+%s'`
if [[ $# == 1 ]];then
CASE_VALUE=$1
if [ "$(($TIMENOW - $TIMECACHE))" -gt "$CACHETTL" ]; then
create_data
fi
zabbix_answer
if [ "$rval" -ne 0 ]; then
echo "ZBX_NOTSUPPORTED"
fi
rm $LOCK
trap - INT TERM EXIT
exit $rval
else
usage
rm $LOCK
trap - INT TERM EXIT
exit 0
fi

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

#!/bin/bash

# Egor Minko. Synchron LLC. May.2012

zexim4ver="ver 2.1"

rval=0

# MULTIPLE PARSERS PROTECTION

LOCK=/tmp/zexim4.pid

while [ -e "$LOCK" ]; do

PID="`cat $LOCK`"

while [ "`ps h -p $PID -o pid,comm|wc -l`" -gt 0 ]

sleep 0.$[ ( $RANDOM % 10 ) + 1 ]s

done

echo $$ > $LOCK

trap "rm -f $LOCK; exit" INT TERM EXIT

# USAGE

function usage()

{

echo "zexim version: $zexim4ver"

echo "usage:"

echo " $0 deliver -- Delivered Messages"

echo " $0 arrive -- Submited Pakets"

echo " $0 error -- Errors Total for Messages"

echo " $0 defer -- Error status: Defered Messages"

echo " $0 unroute -- Error status: Unroutable address"

echo " $0 local -- Local/Virtual delivery of Messages"

echo " $0 complete -- Finished Packets"

echo " $0 reject -- Rejects Total for Packets"

echo " $0 badrelay -- Reject status: Relay not permited"

echo " $0 Pqueue -- Queue size in Packets"

echo " $0 Mqueue -- Queue size in Messages"

echo " $0 frozen -- Frozen Packets"

echo ""

echo " Packet = letter with many recipients"

echo " Message = A single message for one recipient"

echo ""

}

# GLOBAL INSTRUCTIONS

CACHETTL="58" # sec

main_log=/var/log/exim_mainlog

tmp_log=/tmp/exim_log_pars.txt

stats=/tmp/stats.txt

exim=`which exim`

function create_data()

{

# CREATING STATS FILE

if [ ! -e "$stats" ] ; then touch $stats ; fi

# CREATING TMP FILE

# additional 'sub' in 'awk' used for cutting special chars that breaks next 'sed' parsing. For now: []()

position=`tail -1 $stats |awk '{print $1" "$2" "$3}'`

position_log=`tail -1 $main_log | awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print $1" "$2" "$3}'`

# BUILDING REPORT ONLY IF THERE IS DIFFERENCE BETWEEN LAST LINE IN LOG

if [ "$position" == "$position_log" ]

then

vars="0 0 0 0 0 0 0 0 0"

else

if ! grep -qc "" $stats || ! awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log|grep -qc "$position"

then

awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log $main_log > $tmp_log

else

awk '{sub(/\]/,""); sub(/\[/,""); sub(/\)/,""); sub(/\(/,""); print}' $main_log |sed 1,/"$position"/d | sed /"$position"/d > $tmp_log

vars="`awk '\

BEGIN {deliver=0; arrive=0; error=0; local=0; complete=0; reject=0; badrelay=0; defer=0; unroute=0}\

/[-=]>/ { deliver++ }\

/<=/ {arrive++}\

/ \*\* / {error++}\

/[=][=]/ {defer++}\

/al_delivery/ {local++}\

/Completed/ {complete++}\

/rejected/ {reject++}\

/relay not permitted/ {badrelay++}\

/Unrouteable address/ {unroute++}\

END {print deliver" "arrive" "error" "defer" "local" "complete" "reject" "badrelay" "unroute}' $tmp_log`"

queue_size="`$exim -bpc`"

recipients="`exipick -bpu |awk '$2==""{print $1}'|grep -vE "^$"|wc -l`"

frozen="`exiqgrep -zi|wc -l`"

echo $position_log $vars $queue_size $recipients $frozen >> $stats

}

function zabbix_answer()

{

case $CASE_VALUE in

'deliver')

tail -n1 "$stats"|awk '{print $4}'

rval=$?;;

'arrive')

tail -n1 "$stats"|awk '{print $5}'

rval=$?;;

'error')

tail -n1 "$stats"|awk '{print $6}'

rval=$?;;

'defer')

tail -n1 "$stats"|awk '{print $7}'

rval=$?;;

'local')

tail -n1 "$stats"|awk '{print $8}'

rval=$?;;

'complete')

tail -n1 "$stats"|awk '{print $9}'

rval=$?;;

'reject')

tail -n1 "$stats"|awk '{print $10}'

rval=$?;;

'badrelay')

tail -n1 "$stats"|awk '{print $11}'

rval=$?;;

'unroute')

tail -n1 "$stats"|awk '{print $12}'

rval=$?;;

'Pqueue')

tail -n1 "$stats"|awk '{print $13}'

rval=$?;;

'Mqueue')

tail -n1 "$stats"|awk '{print $14}'

rval=$?;;

'frozen')

tail -n1 "$stats"|awk '{print $15}'

rval=$?;;

'version')

echo "$zexim4ver"

rm $LOCK

trap - INT TERM EXIT

exit $rval;;

usage

rm $LOCK

trap - INT TERM EXIT

exit $rval;;

esac

}

if [ -s "$stats" ]; then

TIMECACHE=`stat -c"%Z" "$stats"`

else

TIMECACHE=0

TIMENOW=`date '+%s'`

if [[ $# == 1 ]];then

CASE_VALUE=$1

if [ "$(($TIMENOW - $TIMECACHE))" -gt "$CACHETTL" ]; then

create_data

zabbix_answer

if [ "$rval" -ne 0 ]; then

echo "ZBX_NOTSUPPORTED"

rm $LOCK

trap - INT TERM EXIT

exit $rval

else

usage

rm $LOCK

trap - INT TERM EXIT

exit 0

# chmod +x /etc/zabbix/scripts/exim4.sh

1	# chmod +x /etc/zabbix/scripts/exim4.sh

В скрипте указываем корректный путь к Exim-лог файлу в переменной main_log По умолчанию стоит

main_log=/var/log/exim_mainlog

1	main_log=/var/log/exim_mainlog

Если утилита exipick не установлена в системе (например, на Cpanel-установках), то скачиваем ее с официального сайта и сохраняем под именем /usr/sbin/exipick

# wget -O /usr/sbin/exipick  http://jetmore.org/john/code/exipick

1	# wget -O /usr/sbin/exipick http://jetmore.org/john/code/exipick

# chmod +x /usr/sbin/exipick

1	# chmod +x /usr/sbin/exipick

Проверяем работу утилиты exipick

# exipick -bpu

1	# exipick -bpu

2.Настройка […]

Опубликовано в рубрике Centos, Debian/Ubuntu, Monitoring, Monitoring

Метки: Exim, monitoring, zabbix

Комментарии отключены

Установка и настройка связки Exim+Dovecot+MySQL+PostixAdmin+Roundcube на Centos 7

Октябрь 25th, 2015

Evgeniy Kamenev

1.Установка имени хоста

# hostnamectl set-hostname mail.example.com

1	# hostnamectl set-hostname mail.example.com

# nano /etc/hostname

1	# nano /etc/hostname

mail.example.com

1	mail.example.com

# nano /etc/hosts

1	# nano /etc/hosts

192.168.1.102 mail.example.com mail

1	192.168.1.102 mail.example.com mail

# systemctl restart systemd-hostnamed

1	# systemctl restart systemd-hostnamed

# hostname

1	# hostname

mail.example.com

1	mail.example.com

2.Установка и настройка Nginx

# nano /etc/yum.repos.d/nginx.repo

1	# nano /etc/yum.repos.d/nginx.repo

[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/7/$basearch/
gpgcheck=0
enabled=1

[nginx]

name=nginx repo

baseurl=http://nginx.org/packages/centos/7/$basearch/

gpgcheck=0

enabled=1

# yum update

1	# yum update

# yum install nginx

1	# yum install nginx

# nano nginx.conf

1	# nano nginx.conf

user nginx;
worker_processes 1;
worker_rlimit_nofile 1024;
worker_priority -5;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
use epoll;
multi_accept on;
}


http {
include       /etc/nginx/mime.types;
default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile       on;
tcp_nopush     on;
tcp_nodelay     on;
server_tokens   off;
keepalive_timeout 65;
types_hash_max_size 2048;

gzip on;
gzip_static     on;
gzip_comp_level 5;
gzip_min_length 1024;
gzip_proxied     any;
gzip_vary       on;
gzip_types     text/plain text/xml application/xml application/x-javascript text/javascript text/css text/json font/ttf font/opentype application/vnd.ms-fontobject image/svg+xml;
gzip_disable "msie6";

open_file_cache   max=5000 inactive=20s;
open_file_cache_valid 30s;
open_file_cache_min_uses 2;
open_file_cache_errors   on;

fastcgi_buffer_size 128k;
fastcgi_buffers 4 256k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;

fastcgi_connect_timeout 90;
fastcgi_send_timeout 90;
fastcgi_read_timeout 90;

client_max_body_size 100m;
client_body_buffer_size 8K;

include /etc/nginx/conf.d/*.conf;
}

user nginx;

worker_processes 1;

worker_rlimit_nofile 1024;

worker_priority -5;

error_log /var/log/nginx/error.log warn;

pid /var/run/nginx.pid;

events {

worker_connections 1024;

use epoll;

multi_accept on;

}

http {

include /etc/nginx/mime.types;

default_type application/octet-stream;

log_format main '$remote_addr - $remote_user [$time_local] "$request" '

'$status $body_bytes_sent "$http_referer" '

'"$http_user_agent" "$http_x_forwarded_for"';

access_log /var/log/nginx/access.log main;

sendfile on;

tcp_nopush on;

tcp_nodelay on;

server_tokens off;

keepalive_timeout 65;

types_hash_max_size 2048;

gzip on;

gzip_static on;

gzip_comp_level 5;

gzip_min_length 1024;

gzip_proxied any;

gzip_vary on;

gzip_types text/plain text/xml application/xml application/x-javascript text/javascript text/css text/json font/ttf font/opentype application/vnd.ms-fontobject image/svg+xml;

gzip_disable "msie6";

open_file_cache max=5000 inactive=20s;

open_file_cache_valid 30s;

open_file_cache_min_uses 2;

open_file_cache_errors on;

fastcgi_buffer_size 128k;

fastcgi_buffers 4 256k;

fastcgi_busy_buffers_size 256k;

fastcgi_temp_file_write_size 256k;

fastcgi_connect_timeout 90;

fastcgi_send_timeout 90;

fastcgi_read_timeout 90;

client_max_body_size 100m;

client_body_buffer_size 8K;

include /etc/nginx/conf.d/*.conf;

}

Настройка виртуального хоста по умолчанию

# nano /etc/nginx/conf.d/default.conf

1	# nano /etc/nginx/conf.d/default.conf

server {
listen       192.168.1.102:80 default_server;
server_name localhost;
root         /usr/share/nginx/html;

#charset koi8-r;
access_log /var/log/nginx/default-access.log main;
error_log /var/log/nginx/default-error.log warn;

location / {
try_files $uri $uri/ /index.php?$args;
index index.php index.html index.htm ;
}

#include common/postfixadmin.conf;
#include common/roundcube.conf;

location ~ \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+?\.php)(/.*)?$;
fastcgi_pass   unix:/var/run/php5-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include       fastcgi_params;

}
error_page   500 502 503 504 /50x.html;
location = /50x.html {
root   /usr/share/nginx/html;
}

location ~ /\.ht {
deny all;
  }
}

server {

listen 192.168.1.102:80 default_server;

server_name localhost;

root /usr/share/nginx/html;

#charset koi8-r;

access_log /var/log/nginx/default-access.log main;

error_log /var/log/nginx/default-error.log warn;

location / {

try_files $uri $uri/ /index.php?$args;

index index.php index.html index.htm ;

}

#include common/postfixadmin.conf;

#include common/roundcube.conf;

location ~ \.php$ {

try_files $uri =404;

fastcgi_split_path_info ^(.+?\.php)(/.*)?$;

fastcgi_pass unix:/var/run/php5-fpm.sock;

fastcgi_index index.php;

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

include fastcgi_params;

}

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root /usr/share/nginx/html;

}

location ~ /\.ht {

deny all;

}

# systemctl restart nginx

1	# systemctl restart nginx

# systemctl enable nginx

1	# systemctl enable nginx

3.Установка и настройка PHP-FPM

# yum install php php-fpm php-mysql php-imap php-mbstring php-common php-pdo php-xml

1	# yum install php php-fpm php-mysql php-imap php-mbstring php-common php-pdo php-xml

# nano /etc/php.ini

1	# nano /etc/php.ini

expose_php = Off
max_execution_time = 300
max_input_time = 600
memory_limit = 256M
post_max_size = 100M
cgi.fix_pathinfo=0
upload_max_filesize = 100M
date.timezone = Europe/Kiev

expose_php = Off

max_execution_time = 300

max_input_time = 600

memory_limit = 256M

post_max_size = 100M

cgi.fix_pathinfo=0

upload_max_filesize = 100M

date.timezone = Europe/Kiev

# nano php-fpm.conf

1	# nano php-fpm.conf

emergency_restart_threshold = 10
emergency_restart_interval = 1m
process_control_timeout = 10s
daemonize = yes

emergency_restart_threshold = 10

emergency_restart_interval = 1m

process_control_timeout = 10s

daemonize = yes

# nano /etc/php-fpm.d/www.conf

1	# nano /etc/php-fpm.d/www.conf

listen.owner = nginx
listen.group = nginx
listen.mode = 0660
user = nginx
group = nginx
pm = dynamic
pm.max_children = 50
pm.start_servers = 5
pm.min_spare_servers = 5
pm.max_spare_servers = 35
request_terminate_timeout = 350
request_slowlog_timeout = 3s
slowlog = /var/log/php-fpm/www-slow.log
catch_workers_output = yes
security.limit_extensions = .php .php3 .php4 .php5
php_admin_value[error_log] = /var/log/php-fpm/www-error.log
php_admin_flag[log_errors] = on
php_admin_value[memory_limit] = 256M
php_value[session.save_handler] = files
php_value[session.save_path] = /var/lib/php/session

listen.owner = nginx

listen.group = nginx

listen.mode = 0660

user = nginx

group = nginx

pm = dynamic

pm.max_children = 50

pm.start_servers = 5

pm.min_spare_servers = 5

pm.max_spare_servers = 35

request_terminate_timeout = 350

request_slowlog_timeout = 3s

slowlog = /var/log/php-fpm/www-slow.log

catch_workers_output = yes

security.limit_extensions = .php .php3 .php4 .php5

php_admin_value[error_log] = /var/log/php-fpm/www-error.log

php_admin_flag[log_errors] = on

php_admin_value[memory_limit] = 256M

php_value[session.save_handler] = files

php_value[session.save_path] = /var/lib/php/session

# chgrp -R nginx /var/lib/php/session/

1	# chgrp -R nginx /var/lib/php/session/

# php-fpm -t

1	# php-fpm -t

# systemctl restart php-fpm

1	# systemctl restart php-fpm

# systemctl enable php-fpm

1	# systemctl enable php-fpm

4.Установка и настройка […]

Опубликовано в рубрике Centos, Mail

Метки: dovecot, Exim, postfixadmin, roundcube

Комментарии отключены

Полезные команды Exim

Май 7th, 2015

Evgeniy Kamenev

Получение базовой информации по Exim Проверить правильность синтаксиса конфигурационного файла и узнать с поддержкой каких опций собран exim:

# exim –bV

1	# exim –bV

Вывести количество сообщений в очереди:

# exim –bpc

1	# exim –bpc

Печать списка сообщений в очереди. Выводятся, время постановки в очередь, размер, ID сообщения, отправитель, получатель:

# exim –bp

1	# exim –bp

Просмотр активных отправителей

# exim -bp | awk '{print $4}' | sort | uniq -c | sort -rn

1	# exim -bp \| awk '{print $4}' \| sort \| uniq -c \| sort -rn

Вывод суммарной информации. Выводимые колонки: количество писем, объем, самое старое […]

Опубликовано в рубрике Linux/Unix General, Mail

Метки: exigrep, Exim, eximstats

Комментарии отключены

Установка и настройка почтового сервера на FreeBSD на базе Exim+TLS/SSL c SMTP –авторизацией(Cyrus-Sasl2) с проверкой почты на вирусы(Clamav) и спам(Spamassassin) и с получением почты с помощью Dovecot+TLS/SSL.

Ноябрь 10th, 2013

Evgeniy Kamenev

1.Установка и натсройка Exim+TLS/SSL 2.Установка и настройка Cyrus-Sasl2 3.Установка и натсройка Clamav 4.Установка и настройка Spamassassin 5.Установка и настройка Dovecot+TLS/SSL 6.Тестирование работоспособности Exim и всей связки в целом. Используемое ПО: FreeBSD 8.1 –Release Exim-4.72 Cyrus-sasl2-saslauthd-2.1.23 Clamav-0.96.5 Spamassassin-3.3.1_2 Dovecot-1.2.14_1 1.Установка и настройка Exim #cd /usr/ports/mail/exim #make install clean #rehash (Выбранные опции MBX,NIS,OLD Demine,PAM,PASSWD,SASLAUTHD,SUID,TLS) После установки читаем дальнейшие […]

Опубликовано в рубрике FreeBSD, Mail

Метки: Clamav, Doveoct, Exim, Spamassassin, SSL

Комментарии отключены

Настройка fail2ban для защиты ssh,proftpd,exim,postfix,dovecot на Centos.

Ноябрь 6th, 2013

Evgeniy Kamenev

Установка fail2ban

# yum install fail2ban

1	# yum install fail2ban

1.Настройка конфигурационного файла fail2ban

# grep -v -E '(\#|^$)' /etc/fail2ban/fail2ban.conf

1	# grep -v -E '(\#\|^$)' /etc/fail2ban/fail2ban.conf

[Definition]
loglevel = INFO
logtarget = /var/log/fail2ban.log
syslogsocket = auto
socket = /var/run/fail2ban/fail2ban.sock
pidfile = /var/run/fail2ban/fail2ban.pid
dbfile = /var/lib/fail2ban/fail2ban.sqlite3
dbpurgeage = 86400

[Definition]

loglevel = INFO

logtarget = /var/log/fail2ban.log

syslogsocket = auto

socket = /var/run/fail2ban/fail2ban.sock

pidfile = /var/run/fail2ban/fail2ban.pid

dbfile = /var/lib/fail2ban/fail2ban.sqlite3

dbpurgeage = 86400

2.Настройка Fail2ban для мониторинга логов

# grep -v -E '(\#|^$)' /etc/fail2ban/jail.conf

1	# grep -v -E '(\#\|^$)' /etc/fail2ban/jail.conf

[INCLUDES]
before = paths-fedora.conf
[DEFAULT]
ignoreip = 127.0.0.1/8 159.224.XXX.YYY
ignorecommand =
bantime  = 86400
findtime  = 7200
maxretry = 5
backend = auto
usedns = warn
logencoding = auto
enabled = false
filter = %(__name__)s
destemail = myuser@mydomain.com
sender = root@mydomain.com
mta = sendmail
protocol = tcp
chain = INPUT
port = 0:65535
banaction = iptables-multiport
action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
            %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]
action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             %(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]
action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]
             xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]
action_blocklist_de  = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]
action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]
action = %(action_)s

### SSH
[sshd - iptables]
port = 2200
logpath  = /var/log/secure
maxretry = 3
enabled  = true
filter   = sshd
action = %(action_mwl)s
bantime  = 86400
findtime  = 3600
maxretry = 3

### ProFTPD
[proftpd-iptables]
port     = ftp,ftp-data,ftps,ftps-data
enabled  = true
filter   = proftpd
action = %(action_mwl)s
#action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
#          sendmail-whois[name=ProFTPD, dest=myname@mydomain.com, sender=root@mydomain.com]
logpath  = /var/log/proftpd/proftpd.log
bantime  = 86400
findtime  = 3600
maxretry = 3

###  Exim
[exim-iptables]
port   = smtp,465,submission
enabled  = true
filter   = exim
action = %(action_mwl)s
# action   =  iptables-multiport[name=Exim, port="smtp,smtps,submission", protocol=tcp]
#           sendmail-whois[name=Exim, dest= myname@mydomain.com, sender=root@mydomain.com]
logpath  = /var/log/exim/mainlog
bantime  = 86400
#bantime  = -1 # блокировка навсегда
findtime  = 3600
maxretry = 3

### Dovecot
[dovecot-iptables]
port   = pop3,pop3s,imap,imaps
enabled  = true
filter   = dovecot
action = %(action_mwl)s
# Необходимо указать файл,в котором логируются попытки аутентификации для Dovecot
logpath  = /var/log/secure
#logpath  = /var/log/maillog
#logpath  = /var/log/dovecot.log
bantime  = 86400
findtime  = 3600
maxretry = 3

### Postfix
[postfix-sasl]
enabled = true
port     = smtp,465,submission
logpath  = /var/log/maillog
filter   = postfix-sasl
action = %(action_mwl)s
#action   = iptables[name=postfix-sasl, port=smtp,smtps,submission protocol=tcp]
#           sendmail-whois[name=postfix-sasl, dest=myname@mydomain.com, sender=root@mydomain.com]
bantime  = 604800
findtime  = 3600
maxretry = 3

[postfix-iptables]
enabled = true
port     = smtp,465,submission
logpath = /var/log/maillog
filter = postfix
action = %(action_mwl)s
#action = iptables[name=Postfix-smtp, port=smtp, protocol=tcp]
#        sendmail[name=Postfix-smtp, dest=myname@mydomain.com, sender=root@mydomain.com]
logpath = /var/log/maillog
bantime = 604800
maxretry = 3
findtime = 3600

100

101

102

103

104

105

106

107

108

109

[INCLUDES]

before = paths-fedora.conf

[DEFAULT]

ignoreip = 127.0.0.1/8 159.224.XXX.YYY

ignorecommand =

bantime = 86400

findtime = 7200

maxretry = 5

backend = auto

usedns = warn

logencoding = auto

enabled = false

filter = %(__name__)s

destemail = myuser@mydomain.com

sender = root@mydomain.com

mta = sendmail

protocol = tcp

chain = INPUT

port = 0:65535

banaction = iptables-multiport

action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

%(mta)s-whois[name=%(__name__)s, dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"]

action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

%(mta)s-whois-lines[name=%(__name__)s, dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"]

action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"]

xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"]

action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s"]

action_badips = badips.py[category="%(name)s", banaction="%(banaction)s"]

action = %(action_)s

### SSH

[sshd - iptables]

port = 2200

logpath = /var/log/secure

maxretry = 3

enabled = true

filter = sshd

action = %(action_mwl)s

bantime = 86400

findtime = 3600

maxretry = 3

### ProFTPD

[proftpd-iptables]

port = ftp,ftp-data,ftps,ftps-data

enabled = true

filter = proftpd

action = %(action_mwl)s

#action = iptables[name=ProFTPD, port=ftp, protocol=tcp]

# sendmail-whois[name=ProFTPD, dest=myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/proftpd/proftpd.log

bantime = 86400

findtime = 3600

maxretry = 3

### Exim

[exim-iptables]

port = smtp,465,submission

enabled = true

filter = exim

action = %(action_mwl)s

# action = iptables-multiport[name=Exim, port="smtp,smtps,submission", protocol=tcp]

# sendmail-whois[name=Exim, dest= myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/exim/mainlog

bantime = 86400

#bantime = -1 # блокировка навсегда

findtime = 3600

maxretry = 3

### Dovecot

[dovecot-iptables]

port = pop3,pop3s,imap,imaps

enabled = true

filter = dovecot

action = %(action_mwl)s

# Необходимо указать файл,в котором логируются попытки аутентификации для Dovecot

logpath = /var/log/secure

#logpath = /var/log/maillog

#logpath = /var/log/dovecot.log

bantime = 86400

findtime = 3600

maxretry = 3

### Postfix

[postfix-sasl]

enabled = true

port = smtp,465,submission

logpath = /var/log/maillog

filter = postfix-sasl

action = %(action_mwl)s

#action = iptables[name=postfix-sasl, port=smtp,smtps,submission protocol=tcp]

# sendmail-whois[name=postfix-sasl, dest=myname@mydomain.com, sender=root@mydomain.com]

bantime = 604800

findtime = 3600

maxretry = 3

[postfix-iptables]

enabled = true

port = smtp,465,submission

logpath = /var/log/maillog

filter = postfix

action = %(action_mwl)s

#action = iptables[name=Postfix-smtp, port=smtp, protocol=tcp]

# sendmail[name=Postfix-smtp, dest=myname@mydomain.com, sender=root@mydomain.com]

logpath = /var/log/maillog

bantime = 604800

maxretry = 3

findtime = 3600

3.Настройка Fail2ban фильтров для мониторинга логов Будем использовать все штатные фильтры, которые поставляются в комплекте с fail2ban SSH

# nano /etc/fail2ban/filter.d/sshd.conf

1	# nano /etc/fail2ban/filter.d/sshd.conf

[Definition]
_daemon = sshd
failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$
            ^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$
            ^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ \(serial \d+\) CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$
            ^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$
            ^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$
            ^%(__prefix_line)srefused connect from \S+ \(<HOST>\)\s*$
            ^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$
            ^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$
            ^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$
            ^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$
            ^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$
            ^%(__prefix_line)spam_unix\(sshd:auth\):\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$
ignoreregex =

[Definition]

_daemon = sshd

failregex = ^%(__prefix_line)s(?:error: PAM: )?[aA]uthentication (?:failure|error) for .* from <HOST>( via \S+)?\s*$

^%(__prefix_line)s(?:error: PAM: )?User not known to the underlying authentication module for .* from <HOST>\s*$

^%(__prefix_line)sFailed \S+ for .*? from <HOST>(?: port \d*)?(?: ssh\d*)?(: (ruser .*|(\S+ ID \S+ $serial \d+$ CA )?\S+ %(__md5hex)s(, client user ".*", client host ".*")?))?\s*$

^%(__prefix_line)sROOT LOGIN REFUSED.* FROM <HOST>\s*$

^%(__prefix_line)s[iI](?:llegal|nvalid) user .* from <HOST>\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because not listed in AllowUsers\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because listed in DenyUsers\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because not in any group\s*$

^%(__prefix_line)srefused connect from \S+ $<HOST>$\s*$

^%(__prefix_line)sReceived disconnect from <HOST>: 3: \S+: Auth fail$

^%(__prefix_line)sUser .+ from <HOST> not allowed because a group is listed in DenyGroups\s*$

^%(__prefix_line)sUser .+ from <HOST> not allowed because none of user's groups are listed in AllowGroups\s*$

^(?P<__prefix>%(__prefix_line)s)User .+ not allowed because account is locked<SKIPLINES>(?P=__prefix)(?:error: )?Received disconnect from <HOST>: 11: .+ \[preauth\]$

^(?P<__prefix>%(__prefix_line)s)Disconnecting: Too many authentication failures for .+? \[preauth\]<SKIPLINES>(?P=__prefix)(?:error: )?Connection closed by <HOST> \[preauth\]$

^(?P<__prefix>%(__prefix_line)s)Connection from <HOST> port \d+(?: on \S+ port \d+)?<SKIPLINES>(?P=__prefix)Disconnecting: Too many authentication failures for .+? \[preauth\]$

^%(__prefix_line)spam_unix$sshd:auth$:\s+authentication failure;\s*logname=\S*\s*uid=\d*\s*euid=\d*\s*tty=\S*\s*ruser=\S*\s*rhost=<HOST>\s.*$

ignoreregex =

ProFTPD

# nano /etc/fail2ban/filter.d/proftpd.conf

1	# nano /etc/fail2ban/filter.d/proftpd.conf

[Definition]
_daemon = proftpd
__suffix_failed_login = (User not authorized for login|No such user found|Incorrect password|Password expired|Account disabled|Invalid shell: '\S+'|User in \S+|Limit ($

failregex = ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ USER .* \(Login failed\): %(__suffix_failed_login)s\s*$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ SECURITY VIOLATION: .* login attempted\. *$
            ^%(__prefix_line)s%(__hostname)s \(\S+\[<HOST>\]\)[: -]+ Maximum login attempts \(\d+\) exceeded *$
ignoreregex =

[Definition]

_daemon = proftpd

failregex = ^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ USER .*: no such user found from \S+ \[\S+\] to \S+:\S+ *$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ USER .* $Login failed$: %(__suffix_failed_login)s\s*$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ SECURITY VIOLATION: .* login attempted\. *$

^%(__prefix_line)s%(__hostname)s $\S+\[<HOST>\]$[: -]+ Maximum login attempts $\d+$ exceeded *$

ignoreregex =

Exim

# nano /etc/fail2ban/filter.d/exim.conf

1	# nano /etc/fail2ban/filter.d/exim.conf

[Definition]
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
             ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s$
             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
             ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
ignoreregex =

[Definition]

failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$

^%(pid)s \w+ authenticator failed for (\S+ )?$\S+$ \[<HOST>\](:\d+)?( I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( $set_id=.*$|: \d+ Time\(s$

^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$

^%(pid)s SMTP protocol synchronization error $[^)]*$: rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$

^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\](:\d+)? )?dropped: too many nonmail commands $last was "\S+"$\s*$

ignoreregex =

Dovecot

# nano /etc/fail2ban/filter.d/dovecot.conf

1	# nano /etc/fail2ban/filter.d/dovecot.conf

 [Definition]
_daemon = (auth|dovecot(-auth)?|auth-worker)
failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\$
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disab$
            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying aut$
            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
ignoreregex =

[Definition]

_daemon = (auth|dovecot(-auth)?|auth-worker)

failregex = ^%(__prefix_line)s(%(__pam_auth)s($dovecot:auth$)?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\$

^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disab$

^%(__prefix_line)s(Info|dovecot: auth$default$|auth-worker$\d+$): pam$\S+,<HOST>$: pam_authenticate failed: (User not known to the underlying aut$

^%(__prefix_line)s(auth|auth-worker$\d+$): (pam|passwd-file)$\S+,<HOST>$: unknown user\s*$

ignoreregex =

Postfix

# nano /etc/fail2ban/filter.d/postfix-sasl.conf

1	# nano /etc/fail2ban/filter.d/postfix-sasl.conf

[Definition]
_daemon = postfix/(submission/)?smtp(d|s)
failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$
ignoreregex =

[Definition]

_daemon = postfix/(submission/)?smtp(d|s)

failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$

ignoreregex =

# nano /etc/fail2ban/filter.d/postfix.conf

1	# nano /etc/fail2ban/filter.d/postfix.conf

[Definition]
_daemon = postfix/(submission/)?smtp(d|s)
failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$
            ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$
            ^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
            ^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
ignoreregex =

[Definition]

_daemon = postfix/(submission/)?smtp(d|s)

failregex = ^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 Client host rejected: cannot find your hostname, (\[\S*\]); from=<\S*> to=<\S+> proto=ESMTP helo=<\S*>$

^%(__prefix_line)sNOQUEUE: reject: RCPT from \S+\[<HOST>\]: 450 4\.7\.1 : Helo command rejected: Host not found; from=<> to=<> proto=ESMTP helo= *$

^%(__prefix_line)sNOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$

^%(__prefix_line)simproper command pipelining after \S+ from [^[]*\[<HOST>\]:?$

ignoreregex =

4.Проверка работы фильтра […]

Опубликовано в рубрике Centos, Security

Метки: dovecot, Exim, fail2ban, postfix, Proftpd, security, ssh

Комментарии отключены

Записи с меткой ‘Exim’

Мониторинг Exim в Zabbix

Установка и настройка связки Exim+Dovecot+MySQL+PostixAdmin+Roundcube на Centos 7

Полезные команды Exim

Настройка fail2ban для защиты ssh,proftpd,exim,postfix,dovecot на Centos.

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель