2013-10-30 13:02:59 +00:00
|
|
|
# Fail2ban filter for SOGo authentcation
|
2013-02-11 16:19:48 +00:00
|
|
|
#
|
2013-10-30 13:02:59 +00:00
|
|
|
# Log file usually in /var/log/sogo/sogo.log
|
2013-02-11 16:19:48 +00:00
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
|
|
2013-10-05 09:27:07 +00:00
|
|
|
failregex = ^ sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for user '.*' might not have worked( - password policy: \d* grace: -?\d* expire: -?\d* bound: -?\d*)?\s*$
|
2013-02-11 16:19:48 +00:00
|
|
|
|
2013-03-25 07:43:13 +00:00
|
|
|
ignoreregex =
|
2013-10-30 13:02:59 +00:00
|
|
|
|
|
|
|
|
#
|
|
|
|
|
# DEV Notes:
|
|
|
|
|
#
|
|
|
|
|
# The error log may contain multiple hosts, whereas the first one
|
|
|
|
|
# is the client and all others are poxys. We match the first one, only
|
|
|
|
|
#
|
|
|
|
|
# Author: Arnd Brandes
|
