mirror of https://github.com/fail2ban/fail2ban
30 lines
890 B
Plaintext
30 lines
890 B
Plaintext
# Fail2Ban configuration file for roundcube web server
|
|
#
|
|
#
|
|
#
|
|
|
|
[INCLUDES]
|
|
|
|
before = common.conf
|
|
|
|
[Definition]
|
|
|
|
failregex = ^\s*(\[\])?(%(__hostname)s roundcube: IMAP Error)?: (FAILED login|Login failed) for .*? from <HOST>(\. .* in .*?/rcube_imap\.php on line \d+ \(\S+ \S+\))?$
|
|
|
|
ignoreregex =
|
|
# DEV Notes:
|
|
#
|
|
# Source: https://github.com/roundcube/roundcubemail/blob/master/program/lib/Roundcube/rcube_imap.php#L180
|
|
#
|
|
# Part after <HOST> comes straight from IMAP server up until the " in ....."
|
|
# Earlier versions didn't log the IMAP response hence optional.
|
|
#
|
|
# DoS resistance:
|
|
#
|
|
# Assume that the user can inject "from <HOST>" into the imap response
|
|
# somehow. Write test cases around this to ensure that the combination of
|
|
# arbitrary user input and IMAP response doesn't inject the wrong IP for
|
|
# fail2ban
|
|
#
|
|
# Author: Teodor Micu & Yaroslav Halchenko & terence namusonge & Daniel Black
|