Introduction
Server security is one of the most important aspects of system administration. Attackers frequently attempt to gain unauthorized access through services such as SSH, IMAP, POP3, and other network services by repeatedly trying different username and password combinations. To protect servers from such brute-force attacks, Fail2ban is widely used.
Fail2ban is an intrusion prevention framework that monitors log files and automatically blocks IP addresses that generate multiple failed authentication attempts. By dynamically updating firewall rules, Fail2ban helps reduce unauthorized access attempts and improves overall server security.
In this tutorial, we will explain how to install and configure Fail2ban on Ubuntu 16.04. We will also demonstrate how to create a custom jail to block IP addresses that repeatedly fail IMAP and POP3 authentication on a mail server.
Prerequisites
Before proceeding, ensure that:
- You have root or sudo access to the Ubuntu server.
- The server is running Ubuntu 16.04.
- Internet connectivity is available to install required packages.
Step 1: Install Fail2ban
Install Fail2ban using the apt-get package manager:
apt-get update apt-get install fail2ban
Press Y when prompted to continue the installation.
Step 2: Enable Fail2ban at Boot
Configure Fail2ban to start automatically whenever the server reboots:
systemctl enable fail2ban
Step 3: Start the Fail2ban Service
Start the Fail2ban service:
systemctl start fail2ban
Verify the service status:
systemctl status fail2ban
Configuring Fail2ban for Dovecot (IMAP/POP3)
The following configuration will automatically ban IP addresses that generate multiple failed IMAP or POP3 login attempts.
Step 4: Create a Local Configuration File
Instead of modifying the default configuration directly, create a local copy:
cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
Step 5: Configure a New Jail
Open the configuration file:
vi /etc/fail2ban/jail.local
Append the following section:
[dovecot-pop3imap] enabled = true filter = dovecot-pop3imap port = pop3,pop3s,imap,imaps logpath = /var/log/mail.log maxretry = 20 findtime = 1200 bantime = 3600
Parameter Explanation
| Parameter | Description |
|---|---|
| enabled | Enables the jail |
| filter | Filter name used to detect failed logins |
| port | Ports monitored by the jail |
| logpath | Mail server log file location |
| maxretry | Maximum failed login attempts allowed |
| findtime | Time window (in seconds) for counting failures |
| bantime | Duration (in seconds) the IP remains blocked |
Step 6: Create the Filter File
Create the filter definition file:
vi /etc/fail2ban/filter.d/dovecot-pop3imap.conf
Add the following content:
[Definition] failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.* ignoreregex =
This filter identifies failed IMAP and POP3 authentication attempts in the Dovecot mail logs.
Step 7: Restart Fail2ban
Apply the new configuration by restarting the service:
systemctl restart fail2ban
Verify Fail2ban Status
Check whether the service and jail are running correctly:
fail2ban-client status
Example output:
Status |- Number of jail: 2 `- Jail list: dovecot-pop3imap, sshd
To view detailed information about a specific jail:
fail2ban-client status dovecot-pop3imap
Viewing Fail2ban Logs
Fail2ban maintains its logs in:
/var/log/fail2ban.log
Monitor logs in real time:
tail -f /var/log/fail2ban.log
This helps administrators verify banned IP addresses and troubleshoot configuration issues.
Benefits of Using Fail2ban
- Protects against brute-force login attacks.
- Automatically blocks malicious IP addresses.
- Supports multiple services including SSH, FTP, SMTP, IMAP, POP3, and web applications.
- Lightweight and easy to configure.
- Improves server security without additional hardware or software.
Conclusion
Fail2ban is a simple yet powerful security tool that helps protect Ubuntu servers from unauthorized access attempts and brute-force attacks. By monitoring authentication logs and automatically banning suspicious IP addresses, it significantly reduces the risk of compromised accounts and services.
Following the steps in this guide, you can successfully install Fail2ban on Ubuntu 16.04 and configure custom protection for Dovecot IMAP and POP3 services. Regularly reviewing Fail2ban logs and adjusting ban policies based on your environment will further strengthen your server’s security posture.
Frequently Asked Questions (FAQ)
1. How do I check which IP addresses are currently banned by Fail2ban?
You can view the list of banned IP addresses for a specific jail using:
fail2ban-client status dovecot-pop3imap
Example output:
Status for the jail: dovecot-pop3imap |- Filter | |- Currently failed: 0 | |- Total failed: 45 `- Actions |- Currently banned: 3 |- Total banned: 10 `- Banned IP list: 192.168.1.10 203.0.113.15 198.51.100.25
This command helps administrators monitor blocked IPs and verify that the jail is functioning correctly.
2. How can I manually unban an IP address in Fail2ban?
If a legitimate user is accidentally blocked, you can remove the ban using:
fail2ban-client set dovecot-pop3imap unbanip 192.168.1.10
Replace 192.168.1.10 with the actual IP address you want to unblock. The IP will immediately regain access to the monitored service.
3. Can Fail2ban protect services other than IMAP and POP3?
Yes. Fail2ban supports a wide range of services and applications, including:
- SSH
- FTP servers
- SMTP mail servers
- Apache and Nginx web servers
- WordPress login pages
- MySQL authentication logs
- Custom applications with log files
You can enable built-in jails or create custom filters and jails to protect virtually any service that generates log entries for failed authentication attempts.
Related Articles
If you’re looking to expand your Fail2ban configuration and secure additional services, these guides may be helpful:
- Add Exim Service to Fail2ban on Ubuntu
Add Exim Service to Fail2ban on Ubuntu - Add PureFTP Service to Fail2ban on Ubuntu
Add PureFTP Service to Fail2ban on Ubuntu - Install Jenkins on Ubuntu 16.04
Install Jenkins on Ubuntu 16.04
Talk to our experts
Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here.