From 0426a24719c13e795d3cf8b68eaea20d2723b41f Mon Sep 17 00:00:00 2001 From: sebres Date: Tue, 14 May 2019 15:27:20 +0200 Subject: [PATCH] filter.d/postfix.conf: (closes gh-2426) filter extended to catch "5.1.1" (Recipient address rejected: User unknown in local recipient table) with RCPT (and some session-id instead of "NOQUEUE") --- config/filter.d/postfix.conf | 4 ++-- fail2ban/tests/files/logs/postfix | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index d1505e32..dfc68b5a 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -15,12 +15,12 @@ _port = (?::\d+)? prefregex = ^%(__prefix_line)s> .+$ -mdpr-normal = (?:NOQUEUE: reject:|improper command pipelining after \S+) +mdpr-normal = (?:(?:\w+): reject:|improper command pipelining after \S+) mdre-normal=^RCPT from [^[]*\[\]%(_port)s: 55[04] 5\.7\.1\s ^RCPT from [^[]*\[\]%(_port)s: 45[04] 4\.7\.1 (?:Service unavailable\b|Client host rejected: cannot find your (reverse )?hostname\b) ^RCPT from [^[]*\[\]%(_port)s: 450 4\.7\.1 (<[^>]*>)?: Helo command rejected: Host not found\b ^EHLO from [^[]*\[\]%(_port)s: 504 5\.5\.2 (<[^>]*>)?: Helo command rejected: need fully-qualified hostname\b - ^VRFY from [^[]*\[\]%(_port)s: 550 5\.1\.1\s + ^(RCPT|VRFY) from [^[]*\[\]%(_port)s: 550 5\.1\.1\s ^RCPT from [^[]*\[\]%(_port)s: 450 4\.1\.8 (<[^>]*>)?: Sender address rejected: Domain not found\b ^from [^[]*\[\]%(_port)s:? diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index b56619a4..51e26c8c 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -12,7 +12,8 @@ Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.1 Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 : Sender address rejected: match bad.domain; from= to= proto=SMTP helo=<192.51.100.43> # failJSON: { "time": "2005-08-10T10:55:38", "match": true , "host": "72.53.132.234" } Aug 10 10:55:38 f-vanier-bourgeois postfix/smtpd[2162]: NOQUEUE: reject: VRFY from 72-53-132-234.cpe.distributel.net[72.53.132.234]: 550 5.1.1 : Recipient address rejected: User unknown in local recipient tab - +# failJSON: { "time": "2005-08-13T15:45:46", "match": true , "host": "192.0.2.1" } +Aug 13 15:45:46 server postfix/smtpd[13844]: 00ADB3C0899: reject: RCPT from example.com[192.0.2.1]: 550 5.1.1 : Recipient address rejected: User unknown in local recipient table; from= to= proto=ESMTP helo= # failJSON: { "time": "2005-01-12T11:07:49", "match": true , "host": "181.21.131.88" } Jan 12 11:07:49 emf1pt2-2-35-70 postfix/smtpd[13767]: improper command pipelining after DATA from unknown[181.21.131.88]: