fail2ban/config/filter.d/courier-smtp.conf

# Fail2Ban filter to block relay attempts though a Courier smtp server
#
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = courieresmtpd

prefregex = ^%(__prefix_line)serror,relay=<HOST>,<F-CONTENT>.+</F-CONTENT>$

failregex = ^[^:]*: 550 User (<.*> )?unknown\.?$
            ^msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$

ignoreregex = 

# Author: Cyril Jaquier
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 11 years ago			`# Fail2Ban filter to block relay attempts though a Courier smtp server`
- Added a couriersmtpd filter git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@317 a942ae1a-1317-0410-a47c-b1dcaea8d605 19 years ago			`#`
			`#`

ENH: Improve couriersmtp and add sample logs 12 years ago			`[INCLUDES]`

			`# Read common prefixes. If any customizations available -- read them from`
			`# common.local`
			`before = common.conf`

- Added a couriersmtpd filter git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@317 a942ae1a-1317-0410-a47c-b1dcaea8d605 19 years ago			`[Definition]`

ENH: Improve couriersmtp and add sample logs 12 years ago			`_daemon = courieresmtpd`

Several filters optimized with pre-filtering using new option `prefregex` 8 years ago			`prefregex = ^%(__prefix_line)serror,relay=<HOST>,<F-CONTENT>.+</F-CONTENT>$`

			`failregex = ^[^:]: 550 User (<.> )?unknown\.?$`
			`^msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?(?: \S+)$`
- Added option "ignoreregex" in filter scripts and jail.conf. Feature Request #1283304 git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@458 a942ae1a-1317-0410-a47c-b1dcaea8d605 18 years ago
- Defined default values in .conf. Should fix Debian bug #398758 git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@464 a942ae1a-1317-0410-a47c-b1dcaea8d605 18 years ago			`ignoreregex =`
DOC: in filters, put user relevant doc at top, and developer info at bottom, and remove all the repetative blindly copied stuff that appears in the jail man page 11 years ago
			`# Author: Cyril Jaquier`