Skip to content

Commit 70c0fd7

Browse files
author
Till Brehm
committed
Merge branch '5642-fail2ban-fails-to-detect-failed-dovecot-login-attempts-immediately' into 'develop'
Resolve "Fail2ban fails to detect failed dovecot login attempts immediately" Closes #5642 See merge request ispconfig/ispconfig3!1242
2 parents 7086b00 + 554453a commit 70c0fd7

9 files changed

+18
-13
lines changed

‎install/tpl/debian6_dovecot2.conf.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1
1111
ssl_min_protocol = TLSv1.2
1212
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
1313
ssl_prefer_server_ciphers = no
14+
auth_verbose = yes
1415
mail_max_userip_connections = 100
1516
mail_plugins = quota
1617
passdb {

‎install/tpl/debian_dovecot2.conf.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ ssl_dh = </etc/dovecot/dh.pem
1111
ssl_min_protocol = TLSv1.2
1212
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
1313
ssl_prefer_server_ciphers = no
14+
auth_verbose = yes
1415
mail_max_userip_connections = 100
1516
mail_plugins = $mail_plugins quota
1617
passdb {

‎install/tpl/debian_postfix.conf.master‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ broken_sasl_auth_clients = yes
1515
smtpd_sasl_authenticated_header = yes
1616
smtpd_restriction_classes = greylisting
1717
greylisting = check_policy_service inet:127.0.0.1:10023
18-
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
18+
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, reject_unlisted_recipient, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
1919
smtpd_use_tls = yes
2020
smtpd_tls_security_level = may
2121
smtpd_tls_cert_file = {config_dir}/smtpd.cert

‎install/tpl/fedora_dovecot2.conf.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ ssl_key = </etc/postfix/smtpd.key
99
ssl_min_protocol = TLSv1.2
1010
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
1111
ssl_prefer_server_ciphers = no
12+
auth_verbose = yes
1213
mail_plugins = quota
1314
passdb {
1415
args = /etc/dovecot-sql.conf

‎install/tpl/fedora_postfix.conf.master‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ broken_sasl_auth_clients = yes
1111
smtpd_sasl_authenticated_header = yes
1212
smtpd_restriction_classes = greylisting
1313
greylisting = check_policy_service inet:127.0.0.1:10023
14-
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
14+
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, reject_unlisted_recipient, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
1515
smtpd_use_tls = yes
1616
smtpd_tls_security_level = may
1717
smtpd_tls_cert_file = {config_dir}/smtpd.cert

‎install/tpl/gentoo_postfix.conf.master‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ broken_sasl_auth_clients = yes
1010
smtpd_sasl_authenticated_header = yes
1111
smtpd_restriction_classes = greylisting
1212
greylisting = check_policy_service inet:127.0.0.1:10023
13-
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
13+
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, reject_unlisted_recipient, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
1414
smtpd_use_tls = yes
1515
smtpd_tls_security_level = may
1616
smtpd_tls_cert_file = {config_dir}/smtpd.cert

‎install/tpl/opensuse_dovecot2.conf.master‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ ssl_key = </etc/postfix/smtpd.key
99
ssl_min_protocol = TLSv1.2
1010
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
1111
ssl_prefer_server_ciphers = no
12+
auth_verbose = yes
1213
mail_plugins = quota
1314
passdb {
1415
args = /etc/dovecot/dovecot-sql.conf

‎install/tpl/opensuse_postfix.conf.master‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ broken_sasl_auth_clients = yes
1313
smtpd_sasl_authenticated_header = yes
1414
smtpd_restriction_classes = greylisting
1515
greylisting = check_policy_service inet:127.0.0.1:10023
16-
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
16+
smtpd_recipient_restrictions = permit_mynetworks, reject_unknown_recipient_domain, reject_unlisted_recipient, check_recipient_access proxy:mysql:{config_dir}/mysql-verify_recipients.cf, permit_sasl_authenticated, reject_non_fqdn_recipient, reject_unauth_destination, check_recipient_access proxy:mysql:{config_dir}/mysql-virtual_recipient.cf{greylisting}, check_policy_service unix:private/quota-status
1717
smtpd_use_tls = yes
1818
smtpd_tls_security_level = may
1919
smtpd_tls_cert_file = {config_dir}/smtpd.cert

‎server/plugins-available/postfix_server_plugin.inc.php‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -91,13 +91,13 @@ function update($event_name, $data) {
9191
if (!empty($mail_config['relayhost_user']) || !empty($mail_config['relayhost_password'])) {
9292
$content .= "\n".$mail_config['relayhost'].' '.$mail_config['relayhost_user'].':'.$mail_config['relayhost_password'];
9393
}
94-
94+
9595
if (preg_replace('/^(#[^\n]*|\s+)(:?\n+|)/m','',$content) != '') {
9696
exec("postconf -e 'smtp_sasl_auth_enable = yes'");
9797
} else {
9898
exec("postconf -e 'smtp_sasl_auth_enable = no'");
9999
}
100-
100+
101101
$app->system->exec_safe("postconf -e ?", 'relayhost = '.$mail_config['relayhost']);
102102
file_put_contents('/etc/postfix/sasl_passwd', $content);
103103
chmod('/etc/postfix/sasl_passwd', 0600);
@@ -281,7 +281,7 @@ function update($event_name, $data) {
281281
exec("postconf -X 'smtpd_timeout'");
282282
}
283283
}
284-
284+
285285
if($app->system->is_installed('dovecot')) {
286286
$virtual_transport = 'dovecot';
287287
$configure_lmtp = false;
@@ -347,15 +347,15 @@ function update($event_name, $data) {
347347
if($mail_config['content_filter'] == 'rspamd'){
348348
exec("postconf -X 'receive_override_options'");
349349
exec("postconf -X 'content_filter'");
350-
350+
351351
exec("postconf -e 'smtpd_milters = inet:localhost:11332'");
352352
exec("postconf -e 'non_smtpd_milters = inet:localhost:11332'");
353353
exec("postconf -e 'milter_protocol = 6'");
354354
exec("postconf -e 'milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}'");
355355
exec("postconf -e 'milter_default_action = accept'");
356356

357357
exec("postconf -e 'smtpd_sender_restrictions = ${raslm} permit_mynetworks, ${rslm} permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access proxy:mysql:/etc/postfix/mysql-virtual_sender.cf'");
358-
358+
359359
$new_options = array();
360360
$options = preg_split("/,\s*/", exec("postconf -h smtpd_recipient_restrictions"));
361361
foreach ($options as $key => $value) {
@@ -367,7 +367,7 @@ function update($event_name, $data) {
367367
$new_options[] = $value;
368368
}
369369
exec("postconf -e 'smtpd_recipient_restrictions = ".implode(", ", $new_options)."'");
370-
370+
371371
// get all domains that have dkim enabled
372372
if ( substr($mail_config['dkim_path'], strlen($mail_config['dkim_path'])-1) == '/' ) {
373373
$mail_config['dkim_path'] = substr($mail_config['dkim_path'], 0, strlen($mail_config['dkim_path'])-1);
@@ -384,18 +384,19 @@ function update($event_name, $data) {
384384
unset($dkim_domains);
385385
} else {
386386
exec("postconf -X 'smtpd_milters'");
387+
exec("postconf -X 'non_smtpd_milters'");
387388
exec("postconf -X 'milter_protocol'");
388389
exec("postconf -X 'milter_mail_macros'");
389390
exec("postconf -X 'milter_default_action'");
390-
391+
391392
exec("postconf -e 'receive_override_options = no_address_mappings'");
392393
exec("postconf -e 'content_filter = " . ($configure_lmtp ? "lmtp" : "amavis" ) . ":[127.0.0.1]:10024'");
393394

394395
// fixme: should read this from conf templates
395396
exec("postconf -e 'smtpd_sender_restrictions = ${raslm} check_sender_access regexp:/etc/postfix/tag_as_originating.re, permit_mynetworks, ${rslm} permit_sasl_authenticated, reject_non_fqdn_sender, check_sender_access regexp:/etc/postfix/tag_as_foreign.re, check_sender_access proxy:mysql:/etc/postfix/mysql-virtual_sender.cf'");
396397
}
397398
}
398-
399+
399400
if($mail_config['content_filter'] == 'rspamd' && ($mail_config['rspamd_password'] != $old_ini_data['mail']['rspamd_password'] || $mail_config['content_filter'] != $old_ini_data['mail']['content_filter'])) {
400401
$app->load('tpl');
401402

@@ -404,7 +405,7 @@ function update($event_name, $data) {
404405
if($crypted_password) {
405406
$rspamd_password = $crypted_password;
406407
}
407-
408+
408409
$tpl = new tpl();
409410
$tpl->newTemplate('rspamd_worker-controller.inc.master');
410411
$tpl->setVar('rspamd_password', $rspamd_password);

0 commit comments

Comments
 (0)