Fail2Ban is a tool that helps protect servers from brute-force attacks by scanning log files and banning IP addresses that show malicious activities. This usually means repeated failed login attempts. Fail2Ban is a useful tool for blocking malicious traffic and increasing the security of your server.
The default configuration of Fail2Ban is effective at blocking “loud and proud” brute-force attacks. These are attacks that use high volumes of traffic and are easy to detect.
However, “low and slow” attacks, which use smaller volumes of traffic and are designed to evade detection, may be more difficult to block with the default configuration. These are the most recent email based attacks we saw coming from what I suspect are state-sponsored hacking groups.
To counter slow and low brute-force attacks, you can configure Fail2Ban to have a “short temper” by setting the “findtime” parameter to a lower value.
This will cause Fail2Ban to detect and ban IP addresses more quickly, making it more difficult for attackers to successfully brute-force their way into your server.
You can also configure Fail2Ban to have a “longer memory” by setting the to a higher value. This will cause Fail2Ban to remember banned IP addresses for a longer period of time, making it more difficult for attackers to simply switch to a new IP address and continue the attack. These two ideas credited to redditor u/TyphoidJaneDoeMary.
You then configure Fail2Ban to “Forever ban” IP addresses by setting the “bantime” parameter to a negative 1. Thanks to Jayr Baldevia for this idea. This will cause Fail2Ban to permanently ban any IP addresses that it detects as being malicious, which can be an effective way to prevent repeated attacks from the same source.
Here is what it looks like:
It’s important to note that while these configurations can be effective at blocking brute-force attacks, they may also result in legitimate users being accidentally banned if they make too many failed login attempts. It’s a good idea to carefully monitor the logs and make sure that you’re not accidentally blocking legitimate traffic. In such a case, you ask your user for the IP address and just ‘unban’ it.
Finally, you can try to add two factor authentication. This is a bit hard, but not impossible to do. Clint Canada suggests:
“you let postfix use dovecat as the SASL authentication server in /etc/postfix/main.cf and set up communication to the Unix Socket which ties up to dovecot.
Dovecot can be configured to use pam (this is for use in google authenticator pam modules) or OAuth2 for sign on to an identity server (you can use auth0 which has a free plan of up to 7,000 active users and unlimited logins, but MFA has a payment here).
If you set up keycloak (an open source Java based identity server), you can use OAuth2, then MFA as well.”