{"id":1679,"date":"2017-06-21T21:15:55","date_gmt":"2017-06-21T15:45:55","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=1679"},"modified":"2026-08-26T18:09:36","modified_gmt":"2026-08-26T12:39:36","slug":"add-exim-service-fail2ban-ubuntu","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/add-exim-service-fail2ban-ubuntu\/","title":{"rendered":"Add Exim service on Fail2Ban &#8211; Ubuntu"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\">Introduction<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2Ban is a security tool that helps protect Linux servers from repeated authentication failures and brute-force attacks. When running an Exim mail server, you can configure Fail2Ban to monitor Exim authentication logs and automatically block IP addresses that repeatedly fail authentication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide explains how to configure an <strong>Exim authentication jail in Fail2Ban on Ubuntu<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before configuring Exim with Fail2Ban, make sure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ubuntu server is running.<\/li>\n\n\n\n<li>Exim4 is installed and running.<\/li>\n\n\n\n<li>Fail2Ban is installed.<\/li>\n\n\n\n<li>You have root or sudo access.<\/li>\n\n\n\n<li>Exim logs are available, normally under <code>\/var\/log\/exim4\/<\/code>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If Fail2Ban is not installed, first follow the <strong>Install Fail2Ban on Ubuntu<\/strong> guide.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Implementation<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Step 1: Edit the Fail2Ban jail configuration<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Open the <code>jail.local<\/code> file:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo vi \/etc\/fail2ban\/jail.local<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following configuration:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[exim-auth]<br>enabled = true<br>filter = exim<br>action = iptables[name=SMTP, port=25, protocol=tcp]<br>logpath = \/var\/log\/exim4\/mainlog<br>maxretry = 3<\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Configuration Explanation<\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Parameter<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td><code>enabled = true<\/code><\/td><td>Enables the Exim authentication jail<\/td><\/tr><tr><td><code>filter = exim<\/code><\/td><td>Uses the Exim Fail2Ban filter<\/td><\/tr><tr><td><code>action<\/code><\/td><td>Blocks the offending IP using iptables<\/td><\/tr><tr><td><code>port=25<\/code><\/td><td>Applies the block to SMTP traffic<\/td><\/tr><tr><td><code>logpath<\/code><\/td><td>Specifies the Exim log file<\/td><\/tr><tr><td><code>maxretry = 3<\/code><\/td><td>Blocks an IP after 3 matching failures<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Note:<\/strong> The Exim log location may differ depending on your server configuration. Verify the correct path before restarting Fail2Ban.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">You can check the Exim log location with:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">$ ls -lh \/var\/log\/exim4\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check the Exim configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ exim4 -bP log_file_path<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Step 2: Verify the Exim filter<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Before restarting Fail2Ban, check whether the Exim filter exists:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ls -l \/etc\/fail2ban\/filter.d\/exim.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the file exists, inspect it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ cat \/etc\/fail2ban\/filter.d\/exim.conf<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Step 3: Test the Fail2Ban configuration<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client -t<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A successful configuration should return a message indicating that the configuration is OK.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check the jail configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client status exim-auth<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Step 4: Restart Fail2Ban<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Restart the service:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo systemctl restart fail2ban<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the service status:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo systemctl status fail2ban<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">Step 5: Verify the Exim jail<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client status<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should see <code>exim-auth<\/code> listed among the active jails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Then check its details:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client status exim-auth<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Status for the jail: exim-auth\n|- Filter\n|  |- Currently failed: 0\n|  |- Total failed:     0\n`- Actions\n   |- Currently banned: 0\n   |- Total banned:     0<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Conclusion<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Configuring Exim with Fail2Ban provides an additional layer of protection against repeated SMTP authentication failures and brute-force attempts. By monitoring <code>\/var\/log\/exim4\/mainlog<\/code> and automatically blocking IP addresses after multiple failures, you can reduce unwanted authentication attempts against your mail server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Always test the Fail2Ban configuration before restarting the service and verify that the correct Exim log path is being monitored.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">FAQs<\/h3>\n\n\n\n<h5 class=\"wp-block-heading\">1. What is the default Exim log location on Ubuntu?<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">On most Ubuntu systems using Exim4, the main log is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ \/var\/log\/exim4\/mainlog<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can verify the available Exim logs with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ls -lh \/var\/log\/exim4\/<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">2. How do I check whether the Exim Fail2Ban jail is running?<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client status exim-auth<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">3. How can I see all active Fail2Ban jails?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client status<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">4. How can I manually unban an IP?<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Use:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client set exim-auth unbanip IP_ADDRESS<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client set exim-auth unbanip 192.0.2.10<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">5. How can I manually ban an IP?<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client set exim-auth banip 192.0.2.10<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">6. How do I check the Fail2Ban logs?<\/h5>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo tail -f \/var\/log\/fail2ban.log<\/code><\/pre>\n\n\n\n<h5 class=\"wp-block-heading\">7. What should I do if the Exim jail does not start?<\/h5>\n\n\n\n<p class=\"wp-block-paragraph\">First validate the configuration:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo fail2ban-client -t<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then check:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ sudo journalctl -u fail2ban -n 100 --no-pager<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Also verify that the filter exists:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ ls -l \/etc\/fail2ban\/filter.d\/exim.conf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction Fail2Ban is a security tool that helps protect Linux servers from repeated authentication failures and brute-force attacks. When running [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1040,1022],"tags":[348,274],"class_list":["post-1679","post","type-post","status-publish","format-standard","hentry","category-linux","category-web-architecture","tag-fail2ban","tag-ubuntu","psol-cat-linux"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-r5","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=1679"}],"version-history":[{"count":4,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1679\/revisions"}],"predecessor-version":[{"id":11085,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/1679\/revisions\/11085"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=1679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=1679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=1679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}