fail2banで不正アクセスから保護

#SSH接続のログ
sudo cat /var/log/auth.log | grep ssh

#postfixのログ
sudo grep postfix /var/log/mail.log

#dovecotのログ
sudo grep dovecot /var/log/mail.log

sudo apt update
sudo apt install fail2ban

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port    = ssh
filter  = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
findtime = 600

[postfix]
enabled  = true
port     = smtp,ssmtp,submission
filter   = postfix
logpath  = /var/log/mail.log
maxretry = 5
bantime  = 3600
findtime = 600
action   = iptables[name=postfix, port=smtp, protocol=tcp]

[dovecot]
enabled = true
port = imap,imap2,imaps,pop3,pop3s
filter = dovecot
logpath = /var/log/mail.log
maxretry = 3
bantime = 86400
findtime = 600
action = iptables[name=dovecot, port=imap, protocol=tcp]

[postfix-sasl]
enabled = true
port    = smtp,submission,465
filter  = postfix
logpath = /var/log/mail.log
maxretry = 3

sudo nano /etc/fail2ban/filter.d/postfix.conf

[INCLUDES]
before = common.conf

[Definition]

_daemon = postfix(-\w+)?/\w+(?:/smtp[ds])?
_port = (?::\d+)?
_pref = [A-Z]{4}

prefregex = ^%(__prefix_line)s<mdpr-<mode>> <F-CONTENT>.+</F-CONTENT>$

exre-user = |[Uu](?:ser unknown|ndeliverable address)

mdpr-normal = (?:\w+: (?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+)
mdre-normal=^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|(?:Client host|Command|Data command) rejected|Relay access denied|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b
            ^from [^[]*\[<HOST>\]%(_port)s:?

mdpr-auth = warning:
mdre-auth = ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server| Invalid authentication mechanism)
mdre-auth2= ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server)

mdpr-rbl = %(mdpr-normal)s
mdre-rbl  = ^%(_pref)s from [^[]*\[<HOST>\]%(_port)s: [45]54 [45]\.7\.1 Service unavailable; Client host \[\S+\] blocked\b

# Mode "rbl" currently included in mode "normal" (within 1st rule)
mdpr-more = %(mdpr-normal)s
mdre-more = %(mdre-normal)s
mdpr-ddos = (?:lost connection after(?! DATA) [A-Z]+|disconnect(?= from \S+(?: \S+=\d+)* auth=0/(?:[1-9]|\d\d+))|(?:PREGREET \d+|HANGUP) after \S+|COMMAND (?:TIME|COUNT|LENGTH) LIMIT)
mdre-ddos = ^from [^[]*\[<HOST>\]%(_port)s:?

mdpr-extra = (?:%(mdpr-auth)s|%(mdpr-normal)s)
mdre-extra = %(mdre-auth)s
            %(mdre-normal)s

mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)
mdre-aggressive = %(mdre-auth2)s
                  %(mdre-normal)s

mdpr-errors = too many errors after \S+
mdre-errors = ^from [^[]*\[<HOST>\]%(_port)s$

failregex = ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server| Invalid authentication mechanism)

mode = auth

ignoreregex = 

[Init]

journalmatch = _SYSTEMD_UNIT=postfix.service

sudo systemctl restart fail2ban

sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client status postfix
sudo fail2ban-client status dovecot

Status for the jail: postfix
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  - Journal matches:  _SYSTEMD_UNIT=postfix.service
- Actions
   |- Currently banned: 0
   |- Total banned:     0
   - Banned IP list: