Surgical Diversions » computer

Fail2ban and OS X Server, part deux

Andy Fragen — Thu, 04 Nov 2010 22:10:39 +0000

As some of you might know I run my own installation of OS X Server. I’ve since updated it to Snow Leopard Server and I think I’ve got most of it running well. As I check my server logs frequently I find that there are all sorts of script kiddies attempting to log in to my server in various ways.

The traditional method was to simply try an ssh session with a username and password combination. Unfortunately now I see more attempts to log in via VNC or in attempts to check or send email. It’s amazing to see 10 - 15 login attempts in a second. There’s a real motivating force to stop that kind of attention my poor little server is getting.

As I’ve written before, I’ve found the Fail2ban scripts to to be a perfect solution. I have had to make a number of additions and improvements along the way and now I thought I’d share.

I’ve created a couple of new jails and improved upon a couple of the distribution jails so they work better with Snow Leopard. I’ve packaged up all my modifications. Here’s how to install them for yourself.

Download the modifications tarbell.

Then you’ll need to issue the following commands from Terminal.

sudo tar xzf install_fail2ban_mods.tar.gz

This will create a folder containing all the modifications. At this point you can manually put all the files in the proper folders or you can use my installation script. The installation script, install_fail2ban_mod.sh shouldn’t delete anything. I only use the cp command. If you already have a jail.local file that is backed up. You may also need to modify the jail.local file that I have.

Additionally, I’ve found that sometimes the fail2ban server might have hung or its process has stopped. I’ve also written a script and a couple of plists for /Library/LaunchDaemons/ that periodically check to make sure fail2ban continues to hum along. You’ll have to load these plists manually or simply restart.

The jails that I’ve added check for SMTP, POP, IMAP, VNC and non-existant web pages. These, in addition to monitoring SSH, seem to cover most of it. Please remember that some of these filters are somewhat specific to Snow Leopard so they check against a Dovecot mail server.

So far my only problem has been when a user has changed their password but not correctly transferred these changes to Mail.app. What happens is fail2ban sees them as a break-in attempt and bans their IP for 10 minutes or so. I’m sure it can be frustrating. Sorry, I’m doing my best to fix it for you.

By all means, let me know how you’ve improved Fail2ban for your server.

Checking Fail2ban regex I’ve just stumbled across a great command in Fail2ban to...
Fail2ban on Leopard Server So here I am running my own server — for...
Fail2ban Problems and Solutions If you use Fail2ban then you are probably aware of...

Related posts brought to you by Yet Another Related Posts Plugin.

Customer Service

Andy Fragen — Sat, 21 Aug 2010 19:05:08 +0000

I just had to pass along kudos to APC. I use one of their BackUPS battery backup systems. It’s been flawless for most of the past 3 years. In the past 3 days the overload light has tripped and it shuts off power to everything. Not what you want.

I called tech support. They picked up the phone after only 2-3 rings, ran me through some diagnostics, told me there was probably 18 days left on my warranty. Then they told me they were shipping me a new unit.

They are my customer service heroes.

New Safari Version?? I’ve just spent the last 40 minutes on the phone...
Customer Service I have to give great kudos to Wendy of the...
I’ve been having problems with Airport Base Stations recently. I...

Related posts brought to you by Yet Another Related Posts Plugin.

Verizon Thinks You’re a Spammer

Andy Fragen — Tue, 29 Jun 2010 22:38:46 +0000

They must. Verizon now blocks port 25 and does not allow you to opt out. Why do I care? Well our hospital just opened up free WiFi everywhere and when I found I couldn’t send email I made a couple of trips to the Information Services folks.

They swore up and down that they weren’t blocking anything at the router. An epiphany later and we figured out it was the Verizon DSL they were using for the access points.

Well, the simple solution is to change email to accept SMTP on port 587. This was simple enough to fix on the server. Just uncomment the following line in /etc/postfix/master.cf

#submission inet n - n - - smtpd

Then sudo postfix reload and you’re good to go.

Of course I also had to change my iPhone SMTP to use port 587. The only tricky part was remembering that I have my router set to provide a basic hardware firewall, in addition to the server’s ipfw. I had to open a service and a rule on the router to let TCP traffic on port 587 through.

Forwarding Email in Leopard Server OK, to put it mildly the Workgroup Manager and Email...
Port 25 blocked If you travel, or use your laptop at wireless hot...
Router and Airport 2 Well I found out my router problem was a simpler...

Related posts brought to you by Yet Another Related Posts Plugin.

Don’t Send iCal Replies

Andy Fragen — Wed, 14 Apr 2010 00:18:12 +0000

I came across a great hint in Mac OS X Hints today. It seems that there’s an easy way to interrupt the process of sending an email reply when accepting iCal invites. As I tend to play around with iCal invites a lot (adding and deleting the same event ad nauseum) — I love this.

I wrote up a modified script like in the example and bundled it with a shell script, to install and uninstall the modification. You have to run this shell script using sudo from the CLI (Command Line Interface aka Terminal.app).

The zip file contains the shell script, the modified Mail.scpt AppleScript, and the original Mail.scpt AppleScript.

To install run sudo /path/to/iCal_Reply_Send.sh install
To uninstall run sudo /path/to/iCal_Reply_Send.sh revert
To check usage and status, run /path/to/iCal_Reply_Send.sh

If you don’t like messing with the CLI then there’s a great little shareware app, iCal Reply Checker that does it all, and more.

It seems that neither method interferes with the code signing of iCal as the script in question is not code signed.

Update
It appears that if you’re using an Exchange account in Mail.app that this script is being bypassed and this hint won’t work for you.

iCal - Exchange Time Zone Fix - Chapter 3 I’ve updated the iCal-Invite-Fix script again. This time to allow...
iCal - Exchange Time Zone Fix As any Mac user who deals with Microsoft Exchange invites...
iCal - Exchange Time Zone Fix - part 2 I’ve come across a problem with the original MailExchange2iCal-TZ-fix script....

Related posts brought to you by Yet Another Related Posts Plugin.

New Safari Version??

Andy Fragen — Thu, 08 Apr 2010 18:12:43 +0000

I’ve just spent the last 40 minutes on the phone with Union Bank tech support because for the past 2 weeks I’ve been unable to log in to my online account with Safari. After all this time the tech support person, who was very nice, told me I was missing a patch to Safari.

I told him I have the latest patches to my OS and I am running the most currently available version of Safari. I told me that someone there “got some update patch and could log in.” I told him, with all due respect, I’ve been using Macs for over 20 years. (I got my first Mac 128K in 1985) I was quite certain that there is no more currently available version of Safari. Naturally I ran Software Update and no updates are available.

Currently I’m running OS 10.6.3 and Safari Version 4.0.5 (6531.22.7), according to the About box. I’m not sure why they want to blame Apple, but for their logic to hold true a single user of theirs seems to have a “more up-to-date” version of Safari than is obtainable from either Software Update or Apple’s site.

Fortunately Firefox still works.

Safari Updated Wow, it’s only been 3 days and Apple’s released an...
Über cool Safari add-on Sogudi is very similar to an application by Brent Simmons...
Mark’s Safari Review Safari review. A review of Apple’s new browser, Safari, for...

Related posts brought to you by Yet Another Related Posts Plugin.

iPad Arrives

Andy Fragen — Mon, 05 Apr 2010 22:36:55 +0000

Well, with the Easter weekend over and Apple’s iPad gaining more headlines than anything else, I have to say I want one, but I can wait.

I actually got to touch one. Someone at the hospital brought it with them.

It’s not that heavy.
The display is bright and crisp.
It’s fast.

I played a little with the keyboard and I can see with some practice that it’s quite usable.

I’m more excited to see what’s coming Thursday in the iPhone 4.0 announcement. A unified inbox for the Mail.app and Smart Folders would be great.

The iPad is certainly a machine designed for consuming data, not necessarily manipulating data. There are several scripts that I’ve written that make my life easier and I don’t see anyway of making them work on an iPad or iPhone. Not that it’s a deal-breaker, it just means I can’t use the iPad for much more than I use my iPhone now. Except it’s really a faster, better reading environment. I’ll probably buy one based upon that alone.

Time will tell. But I have to say for all those naysayers, wait till you’ve held one!

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

New IP Address

Andy Fragen — Wed, 16 Dec 2009 22:26:25 +0000

Well, as a cost saving measure and because we really weren’t using more than one, we’ve cut back to a single IP address. Time Warner Cable is the biz Internet provider. They’ve been very helpful in setting up reverse DNS lookups and PTR records, but at the same time the transfer to the new IP really screwed with the cable modem.

I spent many hours with some very nice people at TWC tech support, like Jan, but what eventually fixed the problem was changing the fixed IP I was assigned to another fixed IP.

Long and short is everything, mail, web, etc. seems to be back up and running.

New Safari Version?? I’ve just spent the last 40 minutes on the phone...

Related posts brought to you by Yet Another Related Posts Plugin.

Amavisd settings

Andy Fragen — Mon, 16 Mar 2009 17:03:40 +0000

I run my own mail server on OS X Server. For the most part I have my SpamAssassin settings tweaked pretty well. Unfortunately, there is some spam that seems to have malformed or incomplete MIME boundaries and these messages don’t seem to be getting passed off from Amavisd to SpamAssassin. As such, they seem to be getting through to the recipient with a null value for the spam score.

After a little Googling I found Amavisd critical settings and I think the $final_bad_header_destiny is the key. The default setting is set to D_PASS. I’ve changed mine to D_REJECT now I’ll see what the logs say and see how much non-spam gets caught. Obviously, if enough good stuff doesn’t get through then I’ll have to think of something else.

But the obvoious question remains, Why doesn’t SpamAssassin score these messages?

Running SpamAssassin locally While I haven’t yet gotten an iPhone I’m making preparations....
Unforeseen Circumstances Due to unforeseen circumstances I accidentally trashed my server installation....
Server-Side Email Filtering with Sieve Another post for the peripheral brain. When I first set...

Related posts brought to you by Yet Another Related Posts Plugin.

Backblaze Backup

Andy Fragen — Sat, 14 Mar 2009 01:35:37 +0000

I have an invite or two to distribute for the Backblaze online backup service for OS X. Price is $5 a month per machine for unlimited data. Attached disks are recognized, but not yet network attached storage. My opinion is once they allow for NAS backup it’ll be great.

Leave a comment if you want a link to the beta.

Backup, backup, backup I’m usually not too bad with this, but… Who thinks...
Backup is good Just doing a little backup....

Related posts brought to you by Yet Another Related Posts Plugin.

Laptop Envy

Andy Fragen — Tue, 14 Oct 2008 22:44:04 +0000

OK, I have serious laptop envy. I need a new MacBook. Just have to figure out what to do about no firewire drive. Related posts: Apple USB Ethernet part 2 Well, after spending several hours on the phone with AppleCare... … Continue reading → Related posts:

Apple USB Ethernet part 2 Well, after spending several hours on the phone with AppleCare...
In for repairs Well, I’m going to try and clone my server and...

Related posts brought to you by Yet Another Related Posts Plugin.