fail2ban/config/filter.d/qmail.conf

# Fail2Ban configuration file
#
# Author: Daniel Black
#
#

[INCLUDES]

before = common.conf

[Definition]

_daemon = (?:qmail|rblsmtpd)

#
# These seem to be for two or 3 different patches to qmail or rblsmtpd
# so you'll probably only ever see one of these.

failregex = ^%(__prefix_line)s\d+\.\d+ rblsmtpd: <HOST> pid \d+ \S+ 4\d\d \S+\s*$
            ^%(__prefix_line)s\d+\.\d+ qmail-smtpd: 4\d\d badiprbl: ip <HOST> rbl: \S+\s*$
            ^%(__prefix_line)s\S+ blocked <HOST> \S+ -\s*$