How to detect and prevent brute force attacks on Zimbra

Password policies in ZIMBRA can help prevent malicious users from guessing passwords through brute-force attacks. However, this approach does not appear to resolve the problem completely: after the system locks out an account whose password is being guessed, a spammer can continue guessing with another account, if they know its username. Password policies alone may therefore be insufficient to prevent brute-force password guessing. They may also inconvenience the users whose accounts are targeted: once an account is unlocked, the spammer attacks again, preventing the user from using mail continuously. How to resolve the problem fail2ban or OSSEC can provide another layer of protection by blocking the IP address of a spammer who repeatedly guesses passwords incorrectly, rather than locking the user account. Combining this with password policies can make protection considerably more effective. This article covers installing and configuring fail2ban on ZIMBRA to add another layer of protection. Installing and configuring fail2ban

1. Install the EPEL repo so that fail2ban can be installed.

   [root@EzyMailHosting ~]# yum install fail2ban

2. Edit /etc/fail2ban/jail.conf and add the following configuration. Set bantime (in seconds) and maxretry to suit your needs.

   
   [sasl-iptables]
   enabled  = true
   filter   = sasl
   backend  = polling
   action   = iptables-multiport[name=sasl, port="smtp,465,587", protocol=tcp]
              sendmail-whois[name=sasl, [email protected]]
   logpath  = /var/log/maillog
   bantime  = 86400
   maxretry = 5
   
   [postfix-iptables]
   enabled  = true
   filter   = postfix
   backend  = polling
   action   = iptables-multiport[name=postifx, port="smtp,465,587", protocol=tcp]
              sendmail-whois[name=postifx, [email protected]]
   logpath  = /var/log/maillog
   bantime  = 6400
   maxretry = 5
   
   [zimbra-account]
   enabled  = true
   filter   = zimbra
   action   = iptables-allports[name=zimbra-account]
              sendmail[name=zimbra-account, [email protected]]
   logpath  = /opt/zimbra/log/mailbox.log
   bantime  = 86400
   maxretry = 5
   
   [zimbra-audit]
   enabled  = true
   filter   = zimbra
   action   = iptables-allports[name=zimbra-audit]
              sendmail[name=Zimbra-audit, [email protected]]
   logpath  = /opt/zimbra/log/audit.log
   bantime  = 86400
   maxretry = 5
   
   [zimbra-recipient]
   enabled  = true
   filter   = zimbra
   action   = iptables-allports[name=zimbra-recipient]
                  sendmail[name=Zimbra-recipient, [email protected]]
   logpath  = /var/log/maillog
   findtime = 900
   bantime  = 86400
   maxretry = 5

   * To add an IP whitelist, edit ignoreip. For example, to whitelist 192.168.0.0/24, set it as follows:

   ignoreip = 127.0.0.1/8 192.168.0.0/24

3. Create zimbra.conf in /etc/fail2ban/filter.d/ and copy the following into it:

   
   [Definition]
   failregex = \[ip=<HOST>;\] account - authentication failed for .* \(no such account\)$
                           \[ip=<HOST>;\] security - cmd=Auth; .* error=authentication failed for .*, invalid password;$
                           ;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$
                           \[oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found$
               WARN .*;ip=<HOST>;ua=ZimbraWebClient .* security - cmd=AdminAuth; .* error=authentication failed for .*;$
               INFO .*ip=<HOST>;ua=zclient.*\] .* authentication failed for \[.*\], (invalid password|account not found)+$
   #                        NOQUEUE: reject: RCPT from .*\[<HOST>\]: 550 5.1.1 .*: Recipient address rejected:

4. Start the fail2ban service with this command:

   [root@EzyMailHosting ~]# service fail2ban start