fail2ban/config/filter.d/dovecot.conf

# Fail2Ban filter Dovecot authentication and pop3/imap server
#

[INCLUDES]

before = common.conf

[Definition]

_daemon = (auth|dovecot(-auth)?|auth-worker)

failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
            ^%(__prefix_line)s(Info|dovecot: auth\(default\)|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): (pam|passwd-file)\(\S+,<HOST>\): unknown user\s*$
            ^%(__prefix_line)s(auth|auth-worker\(\d+\)): Info: ldap\(\S*,<HOST>,\S*\): invalid credentials\s*$

ignoreregex = 

[Init]

journalmatch = _SYSTEMD_UNIT=dovecot.service

# DEV Notes:
# * the first regex is essentially a copy of pam-generic.conf
# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)
# * Removed the 'no auth attempts' log lines from the matches because produces
#    lots of false positives on misconfigured MTAs making regexp unusable
#
# Author: Martin Waschbuesch
#         Daniel Black (rewrote with begin and end anchors)
#         Martin O'Neal (added LDAP authentication failure regex)
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`# Fail2Ban filter Dovecot authentication and pop3/imap server`
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605 2011-03-23 20:36:28 +00:00			`#`
ENH: dovecot regexs rewritten and extra failures 2013-06-13 13:52:15 +00:00
			`[INCLUDES]`

			`before = common.conf`
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605 2011-03-23 20:36:28 +00:00
			`[Definition]`

ENH: additional tweek to dovecot regex based on http://chrisgilligan.com/portfolio/fail2ban-regex/ 2013-10-28 23:15:54 +00:00			`_daemon = (auth\|dovecot(-auth)?\|auth-worker)`
ENH: dovecot regexs rewritten and extra failures 2013-06-13 13:52:15 +00:00
Add filter variable __pam_auth to allow easier changing of pam auth backend 2015-01-27 21:34:27 +00:00			`failregex = ^%(__prefix_line)s(%(__pam_auth)s(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S)?\s$`
MRG: remove the "no auth attempts" as per aseques gh-600 2014-01-29 09:43:51 +00:00			`^%(__prefix_line)s(pop3\|imap)-login: (Info: )?(Aborted login\|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?\|tried to use (disabled\|disallowed) \S+ auth)\):( user=<\S>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s$`
Add dovecot auth failure from EL7 2015-01-29 16:11:59 +00:00			`^%(__prefix_line)s(Info\|dovecot: auth\(default\)\|auth-worker\(\d+\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)\|Authentication failure \(password mismatch\?\))\s*$`
Match unknown user in dovecot's passwd-file auth database 2015-04-30 08:53:10 +00:00			`^%(__prefix_line)s(auth\|auth-worker\(\d+\)): (pam\|passwd-file)\(\S+,<HOST>\): unknown user\s*$`
Added regex for LDAP authentication failures 2016-03-21 05:53:23 +00:00			`^%(__prefix_line)s(auth\|auth-worker\(\d+\)): Info: ldap\(\S,<HOST>,\S\): invalid credentials\s*$`
NF: Adding found on a drive filter.d/dovecot.conf git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@770 a942ae1a-1317-0410-a47c-b1dcaea8d605 2011-03-23 20:36:28 +00:00
			`ignoreregex =`
NF: Add systemd journal backend 2013-05-09 23:15:07 +00:00
			`[Init]`

			`journalmatch = _SYSTEMD_UNIT=dovecot.service`
MRG: 0.8.11 to 0.9 Epnoc of selinux is now true UTC Merge multiline support and date detection in filter 2013-11-02 04:59:05 +00:00
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`# DEV Notes:`
			`# * the first regex is essentially a copy of pam-generic.conf`
Added regex for LDAP authentication failures 2016-03-21 05:53:23 +00:00			`# * Probably doesn't do dovecot sql/ldap backends properly (resolved in edit 21/03/2016)`
Removed the -no auth attempts- from the triggers because of lots of FP 2014-01-28 11:44:46 +00:00			`# * Removed the 'no auth attempts' log lines from the matches because produces`
Fix a few typos Found with https://github.com/lucasdemarchi/codespell Signed-off-by: Ruben Kerkhof <ruben@rubenkerkhof.com> 2014-03-24 13:16:52 +00:00			`# lots of false positives on misconfigured MTAs making regexp unusable`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 2013-10-30 13:02:59 +00:00			`#`
			`# Author: Martin Waschbuesch`
			`# Daniel Black (rewrote with begin and end anchors)`
Added regex for LDAP authentication failures 2016-03-21 05:53:23 +00:00			`# Martin O'Neal (added LDAP authentication failure regex)`