# Fail2Ban filter for authentication failures on Cyrus imap server
#
#
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = (?:cyrus/)?(?:imapd?|pop3d?)

failregex = ^%(__prefix_line)sbadlogin: \S+ ?\[<HOST>\] \S+ .*?\[?SASL\(-13\): authentication failure: .*\]?$

ignoreregex = 

# Author: Jan Wagner <waja@cyconet.org>