Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Programming/Scripts

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 26th May 2013, 22:22
Steve85 Steve85 is offline
Junior Member
 
Join Date: Apr 2013
Posts: 26
Thanks: 0
Thanked 0 Times in 0 Posts
Post Fail2Ban dovecot - Filter don`t match

Hello Guys,

i want to protect my imap / pop3 access with fail2ban but it looks like that the regex isn`t matching because nothing happens.

For SSH and other services the fail2ban works great.

Example failed Logins:
---
May 26 22:06:29 vs001 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<peter@63.9>, method=PLAIN, rip=217.133.221.119, lip=80.246.63.9
May 26 22:06:46 vs001 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<user1@63.9>, method=PLAIN, rip=217.133.221.119, lip=80.246.63.9
May 26 22:07:03 vs001 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<sanjay@63.9>, method=PLAIN, rip=217.133.221.119, lip=80.246.63.9
May 26 22:07:20 vs001 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<billing@63.9>, method=PLAIN, rip=217.133.221.119, lip=80.246.63.9
May 26 22:07:37 vs001 dovecot: pop3-login: Disconnected (auth failed, 1 attempts): user=<admin@63.9>, method=PLAIN, rip=217.133.221.119, lip=80.246.63.9
---

I tried this regex:
Code:
failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
AND this:
Code:
failregex = (?: pop3-login|imap-login): .*(?:Disconnected|Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
Any idea?
Reply With Quote
Sponsored Links
  #2  
Old 28th May 2013, 12:57
Steve85 Steve85 is offline
Junior Member
 
Join Date: Apr 2013
Posts: 26
Thanks: 0
Thanked 0 Times in 0 Posts
 
Default

Problem solved.
I had the wrong file

regex are fine.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
ISPConfig3 won't start after update Cracklefish Installation/Configuration 15 28th February 2012 14:11
Postfix can't received email from exterior astra2000 Server Operation 5 17th October 2009 23:26
ISP Config hesitation when opening web pages frankb Installation/Configuration 7 15th December 2008 13:06
network issues now it says "401 The web site is blocked by administrator" Check General 3 26th February 2008 14:22
Apache2 Freezes celtic Server Operation 31 28th May 2007 17:18


All times are GMT +2. The time now is 06:39.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.