fail2ban/config/filter.d/perdition.conf

# Fail2Ban filter for perdition
#
#

[INCLUDES]

before = common.conf

[Definition]

_daemon=perdition.\S+

failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id=".+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: (local authentication failure|Re-Authentication Failure)"$
            ^%(__prefix_line)sFatal Error reading authentication information from client <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+: Exiting child$

ignoreregex =

# Author: Christophe Carles and Daniel Black
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 11 years ago			`# Fail2Ban filter for perdition`
ENH: new filter perdition.conf 12 years ago			`#`
			`#`

			`[INCLUDES]`

			`before = common.conf`

			`[Definition]`

ENH: perdition proxies other types hence daemon can include (perdidtion.(imap\|pop)s?\|managesieve). Also support local authentication resulting in the log message: local authentication failure 12 years ago			`_daemon=perdition.\S+`
ENH: new filter perdition.conf 12 years ago
ENH: authentication_id can be an imap4 quoted string, whatever that is, so using .+ as its id 12 years ago			`failregex = ^%(__prefix_line)sAuth: <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+ client-secure=\S+ authorisation_id=NONE authentication_id=".+" server="\S+" protocol=\S+ server-secure=\S+ status="failed: (local authentication failure\|Re-Authentication Failure)"$`
ENH: new filter perdition.conf 12 years ago			`^%(__prefix_line)sFatal Error reading authentication information from client <HOST>:\d+->(\d{1,3}\.){3}\d{1,3}:\d+: Exiting child$`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 11 years ago
			`ignoreregex =`

			`# Author: Christophe Carles and Daniel Black`