github
/
fail2ban
mirror of https://github.com/fail2ban/fail2ban
1
0
Fork 0
Code Issues Releases Wiki Activity
fail2ban/config/filter.d/dovecot.conf

38 lines
1.8 KiB
Plaintext
Raw Normal View History

DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-30 13:02:59 +00:00
# Fail2Ban filter Dovecot authentication and pop3/imap server
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605
2011-03-23 20:36:28 +00:00
#
ENH: dovecot regexs rewritten and extra failures
2013-06-13 13:52:15 +00:00
[INCLUDES]
before = common.conf
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605
2011-03-23 20:36:28 +00:00
[Definition]
Several filters optimized with pre-filtering using new option `prefregex`
2017-02-21 14:54:59 +00:00
_auth_worker = (?:dovecot: )?auth(?:-worker)?
_daemon = (dovecot(-auth)?|auth)
ENH: dovecot regexs rewritten and extra failures
2013-06-13 13:52:15 +00:00
Several filters optimized with pre-filtering using new option `prefregex`
2017-02-21 14:54:59 +00:00
prefregex = ^%(__prefix_line)s(%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap)-login: )?(?:Info: )?<F-CONTENT>.+</F-CONTENT>$
failregex = ^authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(?:\s+user=\S*)?\s*$
^(?:Aborted login|Disconnected)(?::(?: [^ \(]+)+)? \((?:auth failed, \d+ attempts( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<[^>]+>,)?( method=\S+,)? rip=<HOST>(?:, lip=\S+)?(?:, TLS(?: handshaking(?:: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
^pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
^(?:pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
^ldap\(\S*,<HOST>,\S*\): invalid credentials\s*$
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605
2011-03-23 20:36:28 +00:00
ignoreregex =
NF: Add systemd journal backend
2013-05-09 23:15:07 +00:00
journalmatch = _SYSTEMD_UNIT=dovecot.service
MRG: 0.8.11 to 0.9 Epnoc of selinux is now true UTC Merge multiline support and date detection in filter
2013-11-02 04:59:05 +00:00
more precise date template handling (WARNING: this commit creates possible incompatibilities): - datedetector rewritten more strict as earlier; - default templates can be specified exacter using prefix/suffix syntax (via `datepattern`); - more as one date pattern can be specified using option `datepattern` now (new-line separated); - some default options like `datepattern` can be specified directly in section `[Definition]`, that avoids contrary usage of unnecessarily `[Init]` section, because of performance (each extra section costs time); - option `datepattern` can be specified in jail also (jails without filters); - if first group specified, only this will be cut out from search log-line (e. g.: `^date:[({DATE})]` will cut out only datetime match pattern, and leaves `date:[] failure ip...` for searching in filter); - faster match and fewer searching of appropriate templates (DateDetector.matchTime calls rarer DateTemplate.matchDate now); - standard filters extended with exact prefixed or anchored date templates; template cache introduced (in opposition to default template cache, holds custom templates cached by pattern for possible common usage of same template/regex);
2016-10-07 12:57:45 +00:00
datepattern = {^LN-BEG}TAI64N
{^LN-BEG}
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-30 13:02:59 +00:00
# DEV Notes:
# * the first regex is essentially a copy of pam-generic.conf
Added regex for LDAP authentication failures
2016-03-21 05:53:23 +00:00
# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
Removed the -no auth attempts- from the triggers because of lots of FP
2014-01-28 11:44:46 +00:00
# * Removed the 'no auth attempts' log lines from the matches because produces
Fix a few typos Found with https://github.com/lucasdemarchi/codespell Signed-off-by: Ruben Kerkhof <ruben@rubenkerkhof.com>
2014-03-24 13:16:52 +00:00
# lots of false positives on misconfigured MTAs making regexp unusable
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page
2013-10-30 13:02:59 +00:00
#
# Author: Martin Waschbuesch
# Daniel Black (rewrote with begin and end anchors)
Added regex for LDAP authentication failures
2016-03-21 05:53:23 +00:00
# Martin O'Neal (added LDAP authentication failure regex)
filter.d/dovecot.conf update: - fixes failregex, that ignores failures through some irrelevant info (closes #1623); - ignores whole additionally irrelevant info in anchored regex before fixed failure data `\((?:auth failed, \d+ attempts( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\)` - review, IPv6 compatibility fix, non-capturing groups
2016-11-26 15:50:37 +00:00
# Sergey G. Brester aka sebres (reviewed, optimized, IPv6-compatibility)