mirror of https://github.com/fail2ban/fail2ban
ENH: exim-spam to take honeypot email address as argument. Closes #541
parent
1365a7781b
commit
9c7bb3b97e
|
@ -66,6 +66,7 @@ configuration before relying on it.
|
|||
failregex / ignoreregex
|
||||
* [..e019ab7] Multiple instances of the same action are allowed in the
|
||||
same jail -- use actname option to disambiguate.
|
||||
* Add honeypot email address to exim-spam filter as argument
|
||||
|
||||
ver. 0.8.12 (2013/12/XX) - things-can-only-get-better
|
||||
-----------
|
||||
|
|
|
@ -12,9 +12,19 @@ before = exim-common.conf
|
|||
failregex = ^%(pid)s \S+ F=(<>|\S+@\S+) %(host_info)srejected by local_scan\(\): .{0,256}$
|
||||
^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: .*dnsbl.*\s*$
|
||||
^%(pid)s \S+ %(host_info)sF=(<>|[^@]+@\S+) rejected after DATA: This message contains a virus \(\S+\)\.\s*$
|
||||
^%(pid)s \S+ SA: Action: flagged as Spam but accepted: score=\d+\.\d+ required=\d+\.\d+ \(scanned in \d+/\d+ secs \| Message-Id: \S+\)\. From \S+ \(host=\S+ \[<HOST>\]\) for <honeypot>$
|
||||
|
||||
ignoreregex =
|
||||
|
||||
[Init]
|
||||
|
||||
# Option: honeypot
|
||||
# Notes.: honeypot is an email address that isn't published anywhere that a
|
||||
# legitimate email sender would send email too.
|
||||
# Values: email address
|
||||
|
||||
honeypot = trap@example.com
|
||||
|
||||
# DEV Notes:
|
||||
# The %(host_info) defination contains a <HOST> match
|
||||
#
|
||||
|
|
Loading…
Reference in New Issue