mirror of https://github.com/fail2ban/fail2ban
24 lines
1.3 KiB
Diff
24 lines
1.3 KiB
Diff
diff --git a/config/filter.d/courier-auth.conf b/config/filter.d/courier-auth.conf
|
|
index 1ac33736a..d5ba9c505 100644
|
|
--- a/config/filter.d/courier-auth.conf
|
|
+++ b/config/filter.d/courier-auth.conf
|
|
@@ -11,7 +11,7 @@ before = common.conf
|
|
|
|
_daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)?
|
|
|
|
-failregex = ^%(__prefix_line)sLOGIN FAILED, (?:user|method)=.*, ip=\[<HOST>\]$
|
|
+failregex = ^%(__prefix_line)sLOGIN FAILED, (?:(?!ip=)(?:user=<F-USER>[^,]*</F-USER>|\w+=[^,]*), )*ip=\[<HOST>\]
|
|
|
|
ignoreregex =
|
|
|
|
diff --git a/fail2ban/tests/files/logs/courier-auth b/fail2ban/tests/files/logs/courier-auth
|
|
index 3505e1092..8a20a27fb 100644
|
|
--- a/fail2ban/tests/files/logs/courier-auth
|
|
+++ b/fail2ban/tests/files/logs/courier-auth
|
|
@@ -8,3 +8,5 @@ Nov 13 08:11:53 server imapd-ssl: LOGIN FAILED, user=user@domain.tld, ip=[::ffff
|
|
Apr 17 19:17:11 SERVER courierpop3login: LOGIN FAILED, user=USER@EXAMPLE.org, ip=[::ffff:1.2.3.4]
|
|
# failJSON: { "time": "2005-04-17T19:17:12", "match": true , "host": "192.0.2.4" }
|
|
Apr 17 19:17:12 server imapd-ssl: LOGIN FAILED, method=PLAIN, ip=[::ffff:192.0.2.4]
|
|
+# failJSON: { "time": "2005-04-27T09:00:00", "match": true , "user": "tester", "host": "192.0.2.5" }
|
|
+Apr 27 09:00:00 servername imapd: LOGIN FAILED, user=tester, ip=[::ffff:192.0.2.5], port=[255]
|