2013-10-30 13:02:59 +00:00
|
|
|
# Fail2Ban filter for courier authentication failures
|
2006-10-22 23:49:10 +00:00
|
|
|
#
|
|
|
|
|
|
2013-07-20 14:53:18 +00:00
|
|
|
[INCLUDES]
|
|
|
|
|
|
|
|
|
|
# Read common prefixes. If any customizations available -- read them from
|
|
|
|
|
# common.local
|
|
|
|
|
before = common.conf
|
|
|
|
|
|
2006-10-22 23:49:10 +00:00
|
|
|
[Definition]
|
|
|
|
|
|
2013-07-20 14:53:18 +00:00
|
|
|
_daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
|
|
|
|
|
|
2022-02-09 11:18:23 +00:00
|
|
|
failregex = ^%(__prefix_line)sLOGIN FAILED, (?:(?!ip=)(?:user=<F-USER>[^,]*</F-USER>|\w+=[^,]*), )*ip=\[<HOST>\]
|
2006-11-12 14:52:36 +00:00
|
|
|
|
2006-11-15 18:44:28 +00:00
|
|
|
ignoreregex =
|
2013-10-30 13:02:59 +00:00
|
|
|
|
2016-10-05 17:34:21 +00:00
|
|
|
datepattern = {^LN-BEG}
|
|
|
|
|
|
2013-10-30 13:02:59 +00:00
|
|
|
# Author: Christoph Haas
|
|
|
|
|
# Modified by: Cyril Jaquier
|
