From 9f107403e807093687d65359646f4e6817f3446d Mon Sep 17 00:00:00 2001 From: Ivo Truxa Date: Mon, 13 Jan 2014 01:18:09 +0100 Subject: [PATCH 1/2] Update exim When using Dovecot authentication for Exim, which is relatively common, the current regex for catching authentication failures needs a small tweak. The current plain|login options are too limiting and will only work in the cases when only the Exim's rudimentary built-in authentication is used. There can be not only the dovecot_login shown in this log example, but also dovecot_plain, ntlm, cram, cyrus, md5, and plenty of others. In fact many admins may opt for their own authentication labels, when setting up Exim. For this reason the regex should catch any label. I suggest modifying the regex in the following way: 
^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
--- testcases/files/logs/exim | 3 +++ 1 file changed, 3 insertions(+) diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim index 89fa7f87..84aedcfa 100644 --- a/testcases/files/logs/exim +++ b/testcases/files/logs/exim @@ -37,3 +37,6 @@ # failJSON: { "time": "2013-09-02T09:19:07", "match": true , "host": "118.233.20.68" } 2013-09-02 09:19:07 login authenticator failed for (gkzwsoju) [118.233.20.68]: 535 Incorrect authentication data + +# failJSON: { "time": "2014-01-12T02:07:48", "match": true , "host": "85.214.85.40" } +2014-01-12 02:07:48 dovecot_login authenticator failed for h1832461.stratoserver.net (User) [85.214.85.40]: 535 Incorrect authentication data (set_id=scanner) From 2d8c0b26e443b5b91b16019b7a76dbeb09be3f0c Mon Sep 17 00:00:00 2001 From: Ivo Truxa Date: Mon, 13 Jan 2014 01:38:49 +0100 Subject: [PATCH 2/2] Matching any Exim authentication name As explained in https://github.com/grooverdan/fail2ban/pull/4, in Exim there can be used plenty of other standard authentication names, and in fact the names can be custom. The failregex in Exim filter should catch authentication errors regardless of the name of the authentication. Hence replacing the plain|login with the general \w+ --- config/filter.d/exim.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index 66743390..b5028f0e 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -14,7 +14,7 @@ before = exim-common.conf [Definition] failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ - ^%(pid)s (plain|login) authenticator failed for (\S+ )?\(\S+\) \[\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ + ^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$ ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$ ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$ ^%(pid)s SMTP call from \S+ \[\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$