RoundCube Fail2Ban Plugin post

RoundCube Fail2Ban Plugin is a small plugin that will display a failed login attempts to your syslog or userlogins log file. Using this information Fail2Ban be able to block a user for a set amount of time. The best part, the block is happing at the IP level and blocks the IP address, not the user they are try to log in as.

Download

• tgz | zip | git – Version: 1.0 (2009-Jul-09)

Install

• Place this plugin folder into the RoundCube plugins directory (roundcube/plugins/)
• Add fail2ban to $rcmail_config['plugins'] in your RoundCube config

Note: When downloading this plugin from http://github.com/mattrude/rc-plugin-fail2ban you will need to create a directory called fail2ban and place fail2ban.php in there, ignoring the root directory in the downloaded archive. You may also run ‘git clone git://github.com/mattrude/rc-plugin-fail2ban.git fail2ban’ from the plugins directory.

Fail2Ban Setup

fail2ban/jail.conf:

[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
action   = iptables-multiport[name=roundcube, port="http,https"]
logpath  = /var/www/html/roundcube/logs/userlogins

fail2ban/filter.d/roundcube.conf:

[Definition]
failregex = FAILED login for .*. from <HOST>
ignoreregex =