大家好:

/jail.d/jail.local
[DEFAULT]
ignoreip = 140.117.0.0/16
bantime = 60
findtime = 600
maxretry = 3
[webmail-smtp]
enabled=true
filter=webmail-smtp
port=25

iptables的name是要寫smtp 還是要寫webmail-smtp

action=iptables[name=smtp, port=smtp, protocol=tcp]
logpath=/webmail/smtpd.log
bantime = -1
findtime = 600
maxretry = 5

/filter.d/webmail-smtp.conf
[Definition]

failregex =^\s\W+<HOST>\W.*\W\d\W\s+Negative\s+reply\s\W+504\s+Authentication\s+failed.*

webmail-smtp.conf關鍵字比對也沒問題，可以match到
[2020/04/29 16:59:14] [45.142.195.5:11622-0] Negative reply <504 Authentication failed.>
fail2ban-regex /webmail/smtpd.log /etc/fail2ban/filter.d/webmail-smtp.conf

[Init]
datepattern = ^\W%%Y/%%m/%%d\s+%%H:%%M:%%S\W

因為想要永久封鎖，查了網頁我在action.d/iptables.conf加入兩行

指令 /sbin/service fail2ban restart 但會出錯，可是/filter.d/webmail-smtp.conf 有比對應該沒錯

錯誤的內容
正在啟動 fail2ban：ERROR Error in action definition iptableswemail[name=smtp, port=smtp, protocol=tcp]
ERROR Errors in jail 'webmail-smtp'. Skipping...