I had to create the /plugins directory as there wasn’t one in the root of roundcube, then I put in your fail2ban in it’s own fail2ban directory in plugins – /var/www/html/roundcube/plugins/fail2ban/fail2ban.php I then added $rcmail_config['plugins'] = array(‘fail2ban’); to main.inc.php

I did notice that there was no plugins directory defined in main.inc.php like the log directory $rcmail_config['log_dir'] = ‘logs/’;
I tried $rcmail_config['plugin_dir'] = ‘plugins/’; but it didn’t seem to do anything

I’m puzzled why there wasn’t a plugins directory to begin with

Of note – I’m not using fail2ban/iptables service, I’m using apf and installing Brute Force Monitor since I can’t find a way to use fail2ban with apf (seems to only work with iptables)

What I do want to use your plugin for is to just get the IP logging in the log file for roundcube and then maybe try to get BFM to monitor it

I had to create a plugins directory because there was not one – do I have to specify the location of that in the main.inc.php file?

Thanks!

It seems that the plugin is not loaded.

Please advise how to check…

Thanks!

Would you submit these same patterns on http://www.sshguard.net/support/attacks/submit/ ? We’d be happy to implement them in SSHGuard.

cheers
mic

Thanks!

I’m running Roundcube 0.5.3 on Debian Squeeze and these are the changes I made:

Change the jail-definition to look in logs/errors instead of logs/userlogins and change the regexp in the filter to the following:
.*Login failed for.*. from .

And like you said, there is no need for the plugin any longer, as Roundcube now logs failed logins by default.

Now I am using 0.5 on Ubuntu 10.04, the normal errors log still works for me (ie. It shows the correct IP address of the remote system)

But.. the syntax of the log file changed and I CBF getting my regex to work cos I am not good at it… so I installed this plugin and sure enough I am getting the userlogins error log with the same IP addresses (correct ones)

I have setup fail2ban as per instructions. I can use fail2ban-regex to test my filter and it works. It finds matches in the log file. The jail is setup correctly and starts without errors.

I tested from a remote location today and was never banned after many many attempts… obviously I have done something wrong, or something has changed

jail.conf

[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
logpath  = /usr/share/roundcube/logs/userlogins

filter.d/roundcube.conf

[Definition]
failregex = FAILED login for .*. from 
ignoreregex =

Like I said I have tested the regex against the log file and it finds matches. Enough matches that it should have banned (my default setting is 5 attempts in 10 minutes)

All my other jails are tested and working… just this roundcube jail doesn’t work at all

As a side note, here is the output of the log files compared:

logs/errors

[23-Mar-2011 07:44:12 +0900]: IMAP Error: Login failed for bantest@ictnt.com from
203.10.224.93. LOGIN: Login failed. in /usr/share/roundcube/program/include/rcube_imap.php
on line 192 (POST /webmail/?_task=login&_action=login)

logs/userlogins

[23-Mar-2011 07:44:12 +0900]: FAILED login for bantest from 203.10.224.93

If I could get a regex that works on the standard “errors” file, would that work?

I have also noted that both “errors” and “userlogins” have the same owner:group and permissions

-rw-r--r-- www-data:www-data

So I can’t see why the jail isn’t working please help!

Thanks a lot
Chris

1. config/main.inc.php
2. /etc/fail2ban/jail.conf the logpath was incorrect. For Debian Lenny it should be
logpath=/usr/share/roundcube/logs/userlogins
3. the source code /usr/share/roundcube/plugins/fail2ban/fail2ban.php
It should have:
chmod(“logs/userlogins”,0600);
before and after the line:
error_log(…………);
Because something sets the permissions on that file after every write to an inaccessible 500 permissions(!!!). Yes, r-x——. We need 600 ie rw——- otherwise we get no info on failed login attempts.

[roundcube-24hr]
enabled  = true
port     =  http,https
action   = iptables-multiport[name=roundcube24, port="http,https",protocol=tcp]
sendmail-whois[name=RC-Webmail, dest=root@localhost, sender=fail2ban@localhost]
filter   = roundcube-24hr
logpath  = /var/log/fail2ban.log
maxretry = 2
findtime = 21600
bantime  = 86400

thanks all

So, the IP banned is the router one.

Can you help with this?. Thanks

RoundCube’s ‘native’ error log (logs/errors) doesn’t specify the remote host address, at least not when using the settings I require.

I appreciate that you have taken the time to write this small but very useful plugin, and that you chose to share it with the rest of us.

http://howtoforge.com/forums/showthread.php?t=44168

actually it turns out 0.3.1 already logs auth errors (i don’t know if previous versions did or not)

i set mine up by editing the files as such…

adjust the roundcube log path depending on your install setup – i installed mine manually i don’t know where it normally installs to

add this to /etc/fail2ban/jail.conf:

[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
logpath  = /usr/local/roundcube/logs/errors

create new file /etc/fail2ban/filter.d/roundcube.conf:

[Definition]
failregex = IMAP Error: Authentication for .* () failed ((?:LOGIN|AUTH)):
ignoreregex =

and that is it… roundcube auth failures will be banned using your default settings… or you could adjust the setup in jail.conf with these additions:

findtime = x (in seconds)
bantime = x (in seconds)
maxretry = x (attempts)

example, to setup a one hour ban for 5 failed login attempts within a 10 minute period: findtime = 600, bantime = 3600, maxretry = 5

also, you can setup rules for repeat offenders such as this (my example bans for 24 hours if a host suffers two 1 hour bans within a 6 hour period – aka they just won’t take a hint):

add this to /etc/fail2ban/jail.conf:

[roundcube-24hr]
enabled  = true
port     =  http,https
filter   = roundcube-24hr
logpath  = /var/log/fail2ban.log
maxretry = 2
findtime = 21600
bantime  = 86400

create /etc/fail2ban/filter.d/roundcube-24hr.conf:

[Definition]
failregex = [roundcube] Ban
ignoreregex =