Fail2Ban: login_log filter webmaild

[Bouke]

Hello,

I would like to use a Fail2Ban filter for the cPanel login_log (/usr/local/cpanel/logs).
Unfortunately I am not experienced with these filters. I can't figure out a working regex for webmaild.

I would like to filter rules like these:

[2017-12-26 20:59:45 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)

[2017-12-26 21:00:59 +0100] info [webmaild] 123.123.123.123 - [email protected] "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect

I am not sure how to write the required failregex lines. I am hoping some could kindly help me, please.

 

[rpvw]

You might like to consider CSF/LFD that has a built in rule for login failure detection of cpanel, webmail and whm connections.

More details at : How to Configure Your Firewall for cPanel Services - cPanel Knowledge Base - cPanel Documentation

 

[cPanelMichael]

Hello,

I concur with @rpvw. CSF is likely the best approach if you'd like to avoid writing custom rules.

Thank you.

 

[Bouke]

You might like to consider CSF/LFD that has a built in rule for login failure detection of cpanel, webmail and whm connections.

Many thanks as this is very helpful. I am surprised that CSF works out of the box (although I have changed some things).