Vesta Control Panel - Forum

Dear,

I have this log:

dovecot_plain authenticator failed for ([185.180.222.147]) [112.85.62.150]: 535 Incorrect authentication data

now, I want block IP 185.180.222.147 and no Ip 112.85.62.150.

How can I do it?

Regards

You can do it from "VestaCP/Firewall/Fail2Ban list/+", but Fail1Ban would do automatically.

You can config Fail2Ban for RoundCube intrusions and config a long time ban in Fail2Ban for recurrent IP's too.

Dear,

thank you for reply, but this solutions doesn't work. I think problem is little more complex.
Es: scammer has IP:1.2.3.4 and he uses yahoo web mail server with IP:4.3.2.1, now fail2ban can block IP 4.3.2.1 (I don't need block it ), if I block IP 1.2.3.4 no problem for scammer because he uses IP:4.3.2.1, if I block IP: 4.3.2.1 he change to IP:4.2.3.1 ecc.
I need block source IP:1.2.3.4

Reagrds

Wibols wrote: ↑

Mon Jul 22, 2019 3:01 pm

You can do it from "VestaCP/Firewall/Fail2Ban list/+", but Fail1Ban would do automatically.

You can config Fail2Ban for RoundCube intrusions and config a long time ban in Fail2Ban for recurrent IP's too.

You can create a new Fail2Ban filter in /etc/fail2ban/filter.d/ directory from a existing one, modify it and apply to a jail. Only one filter can be used in every jail, so could be necesary to add another.