diff --git a/config/filter.d/qpsmtpd.conf b/config/filter.d/qpsmtpd.conf new file mode 100644 index 00000000..1859d010 --- /dev/null +++ b/config/filter.d/qpsmtpd.conf @@ -0,0 +1,11 @@ + +[Definition] + +failregex = ^.*535 LOGIN authentication failed for .* from $ +ignoreregex = + +datepattern = ^%%a %%b %%d %%H:%%M:%%S %%Y + +# DEV NOTES: +# +# Author: Tim Lavoie diff --git a/fail2ban/tests/files/logs/qpsmtpd b/fail2ban/tests/files/logs/qpsmtpd new file mode 100644 index 00000000..0fdb6556 --- /dev/null +++ b/fail2ban/tests/files/logs/qpsmtpd @@ -0,0 +1,4 @@ +Thu Aug 19 23:37:09 2021 host.domain.example.com[11793]: 535 LOGIN authentication failed for marta from 2.56.59.87 +Thu Aug 19 23:40:19 2021 host.domain.example.com[11798]: 535 LOGIN authentication failed for diana from 45.144.225.204 +Thu Aug 19 23:41:24 2021 host.domain.example.com[11799]: 535 LOGIN authentication failed for irene from 45.144.225.206 +Thu Aug 19 23:43:45 2021 host.domain.example.com[11843]: 535 LOGIN authentication failed for reality from 37.0.11.124