I need a example of bfd configs that work with Interworx please I continue to have hacking issues and I am getting sick and tired of dealing with this every day on the pop3 and the smtp server.
Here is the log /var/log/maillog entry
Sep 20 22:26:39 fwh vpopmail[6506]: vchkpw-smtp: vpopmail user not found angela@:217.160.252.130
This does not look like its the correct argu
more vpopmail
failed logins from a single address before ban
uncomment to override conf.bfd trig value
TRIG=“10”
uncomment to disable alerting for this rule
SKIP_ALERT=“1”
file must exist for rule to be active
REQ="/var/qmail/bin/qmail-pop3d"
if [ -f “$REQ” ]; then
PORTS=“110,143,993,995”
LP="/var/log/maillog"
TLOG_TF=“vpopmail”
vpopmail [qmail]
ARG_VAL=$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sed -n -e '/vchkpw-pop3: password fail/s /.*password fail \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-pop3: system user not found/s/.*system user not found \([^ ]*\)\(.*\):\([^ ] *\).*/\3:\1/p' -e '/vchkpw-pop3: vpopmail user not found/s/.*vpopmail user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p'
fi
I would advise you copy the correct default rule sets, which work, and only alter them if you understand them, or if you have not changed the rule sets, then from what I can see, your rule set shown is not an original rule set, so I’m not sure where you got them from.
Please see below for the correct default rule set for vpopmail, but also, please understand some bots etc give false details, and you will never stop these attempts on your open services.
failed logins from a single address before ban
uncomment to override conf.bfd trig value
TRIG=“10”
file must exist for rule to be active
REQ="/var/qmail/bin/qmail-pop3d"
if [ -f “$REQ” ]; then
LP="/var/log/maillog"
TLOG_TF=“vpopmail”
vpopmail [qmail]
ARG_VAL=$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sed -n -e '/vchkpw-pop3: password fail/s/.*password fail \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-pop3: system user not found/s/.*system user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-pop3: vpopmail user not found/s/.*vpopmail user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p'
fi
Lastly, you may not receive any other answer from another user, or another user may decide to post, and as its world wide, there maybe long time differences between users who post.
Please can you post from your cron log, all events for bfd, a 60 minute period should surffice but please just show bfd, anything else is not needed
Please can you list all rules you have shown in rules folder for bfd - please do not list the contents, only the rules files shown
Many thanks
John[/QUOTE]
John Here the information that you asked for. I also ran bfd -a several times as root and some of the log entries have more then 10 invalid login attempts and it should have tiggered the ban on iptables but it did not do it.
Many thanks, it does indeed appear to be processing the cron job, and I see your on ver 1-5-2, which does explain the port listing in your rules, and good to see you no longer appear to have zip file rule.
I suspect the version 1-5-2 may not be correctly processing vpopmail and as such, would ask if you could test using version 1-5-1, which I’m pretty sure your going to post that you do not have it, and grabbing bfd from rfxnetworks, would only give you ver 1-5-2.
If I have time today, I’ll post a download link for ver 1-5-1, which you need to install, and ideally, first remove ver 1-5-2 in full, although 1-5-1 will import from 1-5-2, but to be sure, removce it first and start from fresh.
save it into a different folder, called whatever you want and aftr fully removing in full BFD ver 1.5-2, extract and install ver 1.5-1.
I personally would leave the cron at 3 minutes, certainly leave all settings at default until your happy vpopmail is working, and please do not forget to add your IP to ignore.hosts
save it into a different folder, called whatever you want and aftr fully removing in full BFD ver 1.5-2, extract and install ver 1.5-1.
I personally would leave the cron at 3 minutes, certainly leave all settings at default until your happy vpopmail is working, and please do not forget to add your IP to ignore.hosts
Hope that helps
Many thanks
John[/QUOTE]
I downloaded bfd from the link that you provided here and its 1.5.2 not 1.5.2. I am having the same issie and its not writting anything to the log file after running it as root and its reaing the same log files.
ARG_VAL=$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sed -n -e '/vchkpw-pop3: password fail/s/.*password fail \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-pop3: system user not found/s/.*system user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-pop3: vpopmail user not found/s/.*vpopmail user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p'
It works perfect for me, but it does not block smtp attacks like this:
Sep 20 22:26:39 fwh vpopmail[6506]: vchkpw-smtp: vpopmail user not found angela@:217.160.252.130
I tried to make other rule only for smtp attacks with a modified rule regex, ports and service too.
I created a custom rule to block vchkpw-smtp attacks
If you use your normal text editor ie nano /usr/local/bfd/rules/vsmtpmail
Copy the below into that file
failed logins from a single address before ban
uncomment to override conf.bfd trig value
TRIG=“10”
file must exist for rule to be active
REQ="/var/qmail/bin/qmail-smtpd"
if [ -f “$REQ” ]; then
LP="/var/log/maillog"
TLOG_TF=“vsmtpmail”
vpopmail [qmail]
ARG_VAL=$TLOG_PATH $LP $TLOG_TF | sed -e 's/::ffff://' | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | sed -n -e '/vchkpw-smtp: password fail/s/.*password fail \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-smtp: system user not found/s/.*system user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p' -e '/vchkpw-smtp: vpopmail user not found/s/.*vpopmail user not found \([^ ]*\)\(.*\):\([^ ]*\).*/\3:\1/p'
fi
Many thanks, much appreciated and that’s what I wanted to hear thanks.
Bfd ver 151 contains the security risk patch but still covers uppercase and lowercase on egrep, whereas ver 152 is more sleek in egrep searches, and also contains port listings.
That’s as far as I know but I think major changes are for rule sets for services not on IW
- sorry just woke up when I replied to the thread :eek:
