Docker Mailserver
Further login attemps by Fail2Ban banned ip, warning: hostname * does not resolve to address*: Name or service not known #3723
Unanswered
lennartbrandin
asked this question in
Q&A
Replies: 3 comments 8 replies
-
|
That's odd. Your configuration looks good to me. You can verify inside the container if the IP is blocked: Are you using a supported OS? Any unusual network configuration? |
Beta Was this translation helpful? Give feedback.
4 replies
-
|
Well the output looks bad: Any idea what could be wrong? Apologies i seem to have forgot entirely about system information it is a VPS running Ubuntu 22.04.3 LTS x86_64 |
Beta Was this translation helpful? Give feedback.
-
|
The expected output should be something like this: DetailsDid you already check those log files inside the container for errors?
|
Beta Was this translation helpful? Give feedback.
-
|
The logs from the startup are interesting
Afterwards F2B just warns about trying to ban already banned ips
|
Beta Was this translation helpful? Give feedback.
-
|
Seems related to: #3574 |
Beta Was this translation helpful? Give feedback.
-
TLDRTried to setup from scratch (except AttemptIn face of the mentioned issue which was closed without yielding a proper solution and it was on a OS EOL, i tried to setup DMS from scratch except the data and keys to review which nondefault changes i made. Configservices:
mailserver:
image: ghcr.io/docker-mailserver/docker-mailserver:latest
container_name: mailserver
# Provide the FQDN of your mail server here (Your DNS MX record should point to this value)
hostname: mail.myserver.com
env_file: mailserver.env
# More information about the mail-server ports:
# https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/
# To avoid conflicts with yaml base-60 float, DO NOT remove the quotation marks.
ports:
- "25:25" # SMTP (explicit TLS => STARTTLS, Authentication is DISABLED => use port 465/587 instead)
- "143:143" # IMAP4 (explicit TLS => STARTTLS)
- "465:465" # ESMTP (implicit TLS)
- "587:587" # ESMTP (explicit TLS => STARTTLS)
- "993:993" # IMAP4 (implicit TLS)
volumes:
- ./config/dovecot/10-custom.conf:/etc/dovecot/conf.d/10-custom.conf
- ./docker-data/dms/mail-data/:/var/mail/
- ./docker-data/dms/mail-state/:/var/mail-state/
- ./docker-data/dms/mail-logs/:/var/log/mail/
- ./docker-data/dms/config/:/tmp/docker-mailserver/
- ./docker-data/dkim/tmp:/tmp/docker-mailserver/opendkim/keys/myserver.com
- ./docker-data/dkim/etc:/etc/opendkim/keys/myserver.com
- ./docker-data/certs:/certs:ro
- /etc/localtime:/etc/localtime:ro
- "../nginx/letsencrypt/live/mail.myserver.com/fullchain.pem:/tmp/dms/custom-certs/fullchain.pem"
- "../nginx/letsencrypt/live/mail.myserver.com/privkey.pem:/tmp/dms/custom-certs/privkey.pem:ro"
restart: always
stop_grace_period: 1m
# Uncomment if using `ENABLE_FAIL2BAN=1`:
cap_add:
- NET_ADMIN
healthcheck:
test: "ss --listening --tcp | grep -P 'LISTEN.+:smtp' || exit 1"
timeout: 3s
retries: 0
environment:
- ENABLE_UPDATE_CHECK=0
- SPOOF_PROTECTION=0
- ENABLE_FAIL2BAN=1
- SSL_TYPE=manual
- SSL_CERT_PATH=/tmp/dms/custom-certs/fullchain.pem
- SSL_KEY_PATH=/tmp/dms/custom-certs/privkey.pem
- PFLOGSUMM_TRIGGER=daily_cron # logrotate
- LOGWATCH_INTERVAL=dailyThe And ive downloaded the preset LogsUnfortunately the logs still seem the same Fail2Ban logFail2Ban statusDocker logs |
Beta Was this translation helpful? Give feedback.
4 replies
-
|
Is nftables available on the host system, does If you have the ability to test (in a VM or something), can you try running your instance on Debian, to see if the error persist?
I think we had an issue in the past with iptables/nftables with that error messages, but can't find it now, where @georglauterbach provided a fix. But my memories could be wrong tbh 😆 But maybe he have an idea. |
Beta Was this translation helpful? Give feedback.
-
|
You could also try to start a complete new DMS instance, configure just the minimum, activate fail2ban and see if the error is already there. For testing, you could manually ban an IP address |
Beta Was this translation helpful? Give feedback.
-
On a side note why can SASL attempts even be made? Its off by default. ( Banning also doesnt work for normal logins )
Ill try a debian vm next. |
Beta Was this translation helpful? Give feedback.
-
|
PS: When you try Debian, use the Docker upstream repo as described here. Don't use the Docker version included in the Debian repo. The same goes for "docker compose". It's also available in the Docker repo: |
Beta Was this translation helpful? Give feedback.
-
|
I can't be of much help here, but seems we're missing any mention of what version of Debian is used? What kernel? Docker too (although you've been instructed to use latest from Docker not Debian). If this on a NAS that is definitely worth noting. |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Observation
I noticed a large amount of failing login attempts by the same ip. If i look in
setup fail2ban statusit appears as banned, butdocker-compose logs -fcontinues to log further login attempts.There are also specific logs i've only seen with the two domains that currently that seem to bypass fail2ban:
warning: hostname carrier-axis.trumpbuyer.com does not resolve to address 141.98.10.124: Name or service not knownThe high amount of obscure domain request (answered N/A) also made me notice this.
Expectation
Fail2Ban blocks ip, no further login attempts are allowed
Logs
docker-compose logs -fdocker-compose exec mailserver setup fail2ban statusConfigs
Docker-compose.yml
mailserver.env
fail2ban-jail.cf
If i look at the Fail2Ban setup it seems it was set up correctly, yet im unsure of how to test/solve this.
Beta Was this translation helpful? Give feedback.
All reactions