Re: Attack on the James Server
David Matthews <[email protected]>
| Newsgroups | gmane.comp.jakarta.james.user |
|---|---|
| Message-ID | <[email protected]> |
>Hello Paul, >Do you think you would be able to share your experience with others? I'll chip in here as the proponent of fail2ban to watch all the services provided by your server, not just ssh as is most commonly used. The most useful thing for james users will be a working regex, which probably should be in /etc/fail2ban/filter.d/james.local to make sure it doesn't get removed in an upgrade. Also details of any customization made to your logging setup. I presume you made a /etc/fail2ban/jail.local file with your james config (again to prevent an upgrade removing settings). So that would also be helpful to james users. Other james users (with logging matching yours) would just need to copy those files, make them owned root.root and restart fail2ban -- David Matthews [email protected]