Add Exim service on Fail2Ban – Ubuntu

Introduction

Fail2Ban is a security tool that helps protect Linux servers from repeated authentication failures and brute-force attacks. When running an Exim mail server, you can configure Fail2Ban to monitor Exim authentication logs and automatically block IP addresses that repeatedly fail authentication.

This guide explains how to configure an Exim authentication jail in Fail2Ban on Ubuntu.

Prerequisites

Before configuring Exim with Fail2Ban, make sure:

• Ubuntu server is running.
• Exim4 is installed and running.
• Fail2Ban is installed.
• You have root or sudo access.
• Exim logs are available, normally under /var/log/exim4/.

If Fail2Ban is not installed, first follow the Install Fail2Ban on Ubuntu guide.

Implementation

Step 1: Edit the Fail2Ban jail configuration

Open the jail.local file:

$ sudo vi /etc/fail2ban/jail.local

Add the following configuration:

[exim-auth]
enabled = true
filter = exim
action = iptables[name=SMTP, port=25, protocol=tcp]
logpath = /var/log/exim4/mainlog
maxretry = 3

Configuration Explanation

Parameter	Description
enabled = true	Enables the Exim authentication jail
filter = exim	Uses the Exim Fail2Ban filter
action	Blocks the offending IP using iptables
port=25	Applies the block to SMTP traffic
logpath	Specifies the Exim log file
maxretry = 3	Blocks an IP after 3 matching failures

Note: The Exim log location may differ depending on your server configuration. Verify the correct path before restarting Fail2Ban.

You can check the Exim log location with:

$ ls -lh /var/log/exim4/

You can also check the Exim configuration:

$ exim4 -bP log_file_path

Step 2: Verify the Exim filter

Before restarting Fail2Ban, check whether the Exim filter exists:

$ ls -l /etc/fail2ban/filter.d/exim.conf

If the file exists, inspect it:

$ cat /etc/fail2ban/filter.d/exim.conf

Step 3: Test the Fail2Ban configuration

Run:

$ sudo fail2ban-client -t

A successful configuration should return a message indicating that the configuration is OK.

You can also check the jail configuration:

$ sudo fail2ban-client status exim-auth

Step 4: Restart Fail2Ban

Restart the service:

$ sudo systemctl restart fail2ban

Check the service status:

$ sudo systemctl status fail2ban

Step 5: Verify the Exim jail

Run:

$ sudo fail2ban-client status

You should see exim-auth listed among the active jails.

Then check its details:

$ sudo fail2ban-client status exim-auth

Example:

Status for the jail: exim-auth
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
`- Actions
   |- Currently banned: 0
   |- Total banned:     0

Conclusion

Configuring Exim with Fail2Ban provides an additional layer of protection against repeated SMTP authentication failures and brute-force attempts. By monitoring /var/log/exim4/mainlog and automatically blocking IP addresses after multiple failures, you can reduce unwanted authentication attempts against your mail server.

Always test the Fail2Ban configuration before restarting the service and verify that the correct Exim log path is being monitored.

FAQs

1. What is the default Exim log location on Ubuntu?

On most Ubuntu systems using Exim4, the main log is:

$ /var/log/exim4/mainlog

You can verify the available Exim logs with:

$ ls -lh /var/log/exim4/

2. How do I check whether the Exim Fail2Ban jail is running?

Run:

$ sudo fail2ban-client status exim-auth

3. How can I see all active Fail2Ban jails?

Run:

$ sudo fail2ban-client status

4. How can I manually unban an IP?

Use:

$ sudo fail2ban-client set exim-auth unbanip IP_ADDRESS

For example:

$ sudo fail2ban-client set exim-auth unbanip 192.0.2.10

5. How can I manually ban an IP?

$ sudo fail2ban-client set exim-auth banip 192.0.2.10

6. How do I check the Fail2Ban logs?

$ sudo tail -f /var/log/fail2ban.log

7. What should I do if the Exim jail does not start?

First validate the configuration:

$ sudo fail2ban-client -t

Then check:

$ sudo journalctl -u fail2ban -n 100 --no-pager

Also verify that the filter exists:

$ ls -l /etc/fail2ban/filter.d/exim.conf