Thread: [ErrorLog] Client IP Address

but if someone DOES get access, and does not belong on your site, you should also block him, or not ?

so, i think, you need 2 things:
1) a decent way in roundcube to block a user after i.e. 3 wrong passwords.
2) your solution to block user-access to your site (using i.e. fail2ban)

Well, exactly.
But first step would be fine to log correctly so i can block users by fail2ban, since not being able to connect to the site for e.g 5 minutes is quite enough to ensure him a long turn until he gets passwords cracked.

I have the same setup for imap, pop3, imaps and pop3s, and think it's a quite good solution.
Any script kiddie who can use autoit (in example) can do both, use a application to try cracking passwords and trying to log in on roundcube.

But indeed, I'd like to see a "lock user" function in roundcube, if too many bad logins have been made - what'd be rather a feature request. Maybe both are, but I think the first one (ip address to log) can be done easily. Hopefully it's standard one day for roundcube .

Kind regards,
// STi

but, a blocked user on IMAP, is a blocked user on Roundcube...

so, if imap is block after a few attempts, you should have reached what you want (informing the user that he/she is blocked is not needed for a script-kid )

Originally Posted by JSkywalker

but, a blocked user on IMAP, is a blocked user on Roundcube...

so, if imap is block after a few attempts, you should have reached what you want (informing the user that he/she is blocked is not needed for a script-kid )

True, but in this case false.
I can't block the IP address of the IMAP client connecting, since roundcube connects as "localhost". Therefore, the failed login attempt is from localhost - which I had to ignore, since I'd block the whole webmail on failed webmail login attempts.

That's why I need roundcube to log the IP of the user attempting to connect, to block http, https, and imap(s) / pop3(s).

Kind regards,
// STi

For a fast information "how to get it working":

Code:

vi program/lib/imap.inc
$conn->error    .= 'Authentication for ' . $user . ' (' . getenv("REMOTE_ADDR") . ') failed (LOGIN): "';
$conn->error    .= 'Authentication for ' . $user . ' (' . getenv("REMOTE_ADDR") . ') failed (AUTH): "';

in /etc/fail2ban/jail.conf (in my case)

Code:

[roundcube]
enabled  = true
port     = http,https
filter   = roundcube
action   = iptables-multiport[name=roundcube, port="http,https"]
logpath  = /home/httpd/html/~roundcubemail/logs/errors

in /etc/fail2ban/filter.d/roundcube.conf

Code:

[Definition]
failregex = IMAP Error: Authentication for .* \(<HOST>\) failed \((?:LOGIN|AUTH)\):
ignoreregex =

Kind regards,
// STi

Hello STiAT,

Thanks for the tip!
It works perfectly, and should definitely be added to Roundcube code!

Regards.

Check out the RoundCube Fail2Ban Plugin also as a quick and easy way to do this.