[zimbra-account]
 
enabled  = true
filter   = zimbra
action   = iptables-allports[name=Zimbra-account]
           sendmail[name=Zimbra-account, dest=it@enabletv.com]
logpath  = /opt/zimbra/log/mailbox.log
bantime  = -1
maxretry = 5
 
 
[zimbra-audit]
 
enabled  = true
filter   = zimbra
action   = iptables-allports[name=Zimbra-audit]
           sendmail[name=Zimbra-audit, dest=it@enabletv.com]
logpath  = /opt/zimbra/log/audit.log
bantime  = -1
maxretry = 5
 
[zimbra-recipient]
 
enabled  = true
filter   = zimbra
action   = iptables-allports[name=Zimbra-recipient]
           sendmail[name=Zimbra-recipient, dest=it@enabletv.com]
logpath  = /var/log/maillog
findtime = 604800
bantime  = 172800
maxretry = 5
 
[postfix]
 
enabled  = true
filter   = postfix
action   = iptables-multiport[name=Postfix, port=smtp, protocol=tcp]
           sendmail-buffered[name=Postfix, dest=it@enabletv.com]
logpath  = /var/log/maillog
bantime  = 172800
maxretry = 5

# Fail2Ban configuration file
#
# Author: 
#
# $Revision: 1 $
#
 
[Definition]
 
# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = \[ip=<HOST>;\] account - authentication failed for .* \(no such account\)$
            \[ip=<HOST>;\] security - cmd=Auth; .* error=authentication failed for .*, invalid password;$
            ;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$
            \[oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found$
            WARN .*;ip=<HOST>;ua=ZimbraWebClient .* security - cmd=AdminAuth; .* error=authentication failed for .*;$
            NOQUEUE: reject: RCPT from .*\[<HOST>\]: 550 5.1.1 .*: Recipient address rejected:
 
# .*\[ip=<HOST>;\] .* - authentication failed for .* \(invalid password\)
# 
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

[root@mail fail2ban]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-Zimbra-audit  tcp  --  anywhere             anywhere  
 
Chain fail2ban-Zimbra-audit (1 references)
target     prot opt source                 destination         
DROP       all  --  bad.spammer.com    anywhere            
DROP       all  --  legitimate.user.com   anywhere

iptables -D fail2ban-Zimbra-audit 2

#!/bin/bash
 
clear
echo -e "##############################################################################"
echo -e "# Zimbra getuserCSV.sh ver 0.1                                               #"
echo -e "##############################################################################"
 
# /* Paramètres */
echo ""
echo -n "Nom de domaine (ex : zimbra.com) : "
read NOM_DOMAINE
echo -n "Nom du fichier export (ex : /tmp/utilisateurs.csv) : "
read NOM_FICHIER
 
rm -f $NOM_FICHIER
 
touch $NOM_FICHIER
 
# Vérification version ZCS
VERSION=`su - zimbra -c 'zmcontrol -v'`;
ZCS_VER="/tmp/zcsver.txt"
 
# Récupération password LDAP
ZIMBRA_LDAP_PASSWORD=`su - zimbra -c "zmlocalconfig -s zimbra_ldap_password | cut -d ' ' -f3"`
LDAP_MASTER_URL=`su - zimbra -c "zmlocalconfig -s ldap_master_url | cut -d ' ' -f3"`
 
touch $ZCS_VER
echo $VERSION > $ZCS_VER
 
echo -e "Récupération utilisateurs"
 
grep "Release 5." $ZCS_VER
if [ $? = 0 ]; then
  USERS=`su - zimbra -c 'zmprov gaa'`;
fi
 
grep "Release 6." $ZCS_VER
if [ $? = 0 ]; then
  USERS=`su - zimbra -c 'zmprov -l gaa'`;
fi
 
grep "Release 7." $ZCS_VER
if [ $? = 0 ]; then
  USERS=`su - zimbra -c 'zmprov -l gaa'`;
fi
 
echo -e "Traitement utilisateurs"
for ACCOUNT in $USERS; do
   NAME=`echo $ACCOUNT`;
   DOMAIN=`echo $ACCOUNT | awk -F@ '{print $2}'`;
   ACCOUNT=`echo $ACCOUNT | awk -F@ '{print $1}'`;
   ACC=`echo $ACCOUNT | cut -d '.' -f1`
 
  if [ $NOM_DOMAINE == $DOMAIN ] ;
  then
        OBJECT="(&(objectClass=zimbraAccount)(mail=$NAME))"
        dn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep dn:`
        displayName=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep displayName: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`
        givenName=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep givenName: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`
        #userPassword=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep userPassword: | cut -d ':' -f3 | sed 's/^ *//g' | sed 's/ *$//g'`
        cn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep cn: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`
        #initials=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep initials: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`
        sn=`/opt/zimbra/bin/ldapsearch -H $LDAP_MASTER_URL -w $ZIMBRA_LDAP_PASSWORD -D uid=zimbra,cn=admins,cn=zimbra -x $OBJECT | grep sn: | cut -d ':' -f2 | sed 's/^ *//g' | sed 's/ *$//g'`
 
        if [ $ACC == "admin" ] || [ $ACC == "wiki" ] || [ $ACC == "galsync" ] || [ $ACC == "ham" ] || [ $ACC == "spam" ]; then
          echo "Utilisateur système non traité : $NAME"
        else
          echo "$NAME;'$displayName';'$givenName';'$sn'" >> $NOM_FICHIER
        fi
  else
    echo "Utilisateur $NAME non traité"
  fi
 
done
 
echo -e "Tous les comptes ont été exportés dans $NOM_FICHIER..."