2013-10-30 13:02:59 +00:00
# Fail2Ban filter for exim
2006-12-23 09:49:19 +00:00
#
2013-10-30 13:02:59 +00:00
# This includes the rejection messages of exim. For spam and filter
# related bans use the exim-spam.conf
2006-12-23 09:49:19 +00:00
#
2013-07-02 10:03:16 +00:00
[INCLUDES]
# Read common prefixes. If any customizations available -- read them from
# exim-common.local
before = exim-common.conf
2006-12-23 09:49:19 +00:00
[Definition]
2013-07-01 11:50:35 +00:00
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
2013-08-25 13:02:10 +00:00
^%(pid)s (plain|login) authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
2013-07-02 10:03:16 +00:00
^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
2013-11-12 07:13:35 +00:00
^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
2013-07-02 10:03:16 +00:00
^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
2006-12-23 09:49:19 +00:00
ignoreregex =
2013-10-30 13:02:59 +00:00
# DEV Notes:
# The %(host_info) defination contains a <HOST> match
#
2013-11-12 07:13:35 +00:00
# SMTP protocol synchronization error \([^)]*\) <- This needs to be non-greedy
# to void capture beyond ")" to avoid a DoS Injection vulnerabilty as input= is
# user injectable data.
#
2013-10-30 13:02:59 +00:00
# Author: Cyril Jaquier
# Daniel Black (rewrote with strong regexs)
