diff --git a/0.6.1-8/debian/changelog b/0.6.1-8/debian/changelog
index 69961ff4..a0bac42e 100644
--- a/0.6.1-8/debian/changelog
+++ b/0.6.1-8/debian/changelog
@@ -1,3 +1,11 @@
+fail2ban (0.6.1-7bpo3) sarge-backports; urgency=low
+
+  * Adjustsed failregex'es in non-iptables (shorewall, hostsdeny) example
+    files. That is to fix issue reported at
+    http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6302
+
+ -- Yaroslav Halchenko <debian@onerussian.com>  Thu, 22 Feb 2007 20:26:10 -0500
+
 fail2ban (0.6.1-7bpo2) sarge-backports; urgency=low
 
   * Backported build of Debian package version 0.6.1-8 by pbuilder-ssh
diff --git a/0.6.1-8/debian/patches/00list b/0.6.1-8/debian/patches/00list
index eb9074b2..121b5a61 100644
--- a/0.6.1-8/debian/patches/00list
+++ b/0.6.1-8/debian/patches/00list
@@ -2,3 +2,5 @@
 00_vsftpd_regexp
 01_apache2_other
 02_sasl_section
+03_failregexes
+04_iptables-n
diff --git a/0.6.1-8/debian/patches/02_sasl_section.dpatch b/0.6.1-8/debian/patches/02_sasl_section.dpatch
index f4c9fd77..89e9428c 100755
--- a/0.6.1-8/debian/patches/02_sasl_section.dpatch
+++ b/0.6.1-8/debian/patches/02_sasl_section.dpatch
@@ -5,14 +5,113 @@
 ## DP: Added saslauthd section from martin f krafft <madduck@debian.org>
 
 @DPATCH@
-
-diff -x '*~' -Naur fail2ban-0.6.1.pre/config/fail2ban.conf.iptables fail2ban-0.6.1.post/config/fail2ban.conf.iptables
---- fail2ban-0.6.1.pre/config/fail2ban.conf.iptables	2006-05-30 10:03:16.000000000 -0400
-+++ fail2ban-0.6.1.post/config/fail2ban.conf.iptables	2006-05-30 10:13:56.000000000 -0400
+diff -urNad 0.6.1-8~/config/fail2ban.conf.hostsdeny 0.6.1-8/config/fail2ban.conf.hostsdeny
+--- 0.6.1-8~/config/fail2ban.conf.hostsdeny	2007-02-22 21:06:31.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.hostsdeny	2007-02-22 21:06:31.000000000 -0500
+@@ -215,6 +215,46 @@
+ # failregex.
+ 
+ 
++[SASL]
++# Option:  enabled
++# Notes.:  enable monitoring for this section.
++# Values:  [true | false]  Default:  true
++#
++enabled = false
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default:
++#
++port = smtp
++
++# Option:  logfile
++# Notes.:  logfile to monitor.
++# Values:  FILE  Default:  /var/log/auth.log
++#
++logfile = /var/log/mail.log
++
++# Option:  timeregex
++# Notes.:  regex to match timestamp
++# Values:  [Mar  7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option:  timepattern
++# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
++#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option:  failregex
++# Notes.:  regex to match the password failures messages in the logfile.
++# Values:  TEXT  Default:
++#
++failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
++
++
+ [Apache]
+ # Option:  enabled
+ # Notes.:  enable monitoring for this section.
+diff -urNad 0.6.1-8~/config/fail2ban.conf.iptables 0.6.1-8/config/fail2ban.conf.iptables
+--- 0.6.1-8~/config/fail2ban.conf.iptables	2007-02-22 21:06:31.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.iptables	2007-02-22 21:06:31.000000000 -0500
 @@ -260,6 +260,46 @@
  # failregex.
  
  
++[SASL]
++# Option:  enabled
++# Notes.:  enable monitoring for this section.
++# Values:  [true | false]  Default:  true
++#
++enabled = false
++
++# Option:  port
++# Notes.:  specifies port to monitor
++# Values:  [ NUM | STRING ]  Default:
++#
++port = smtp
++
++# Option:  logfile
++# Notes.:  logfile to monitor.
++# Values:  FILE  Default:  /var/log/auth.log
++#
++logfile = /var/log/mail.log
++
++# Option:  timeregex
++# Notes.:  regex to match timestamp
++# Values:  [Mar  7 17:53:28]
++# Default: \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++#
++timeregex = \S{3}\s{1,2}\d{1,2} \d{2}:\d{2}:\d{2}
++
++# Option:  timepattern
++# Notes.:  format used in "timeregex" fields definition. Note that '%' must be
++#          escaped with '%' (see http://rgruet.free.fr/PQR2.3.html#timeModule)
++# Values:  TEXT  Default:  %%b %%d %%H:%%M:%%S
++#
++timepattern = %%b %%d %%H:%%M:%%S
++
++# Option:  failregex
++# Notes.:  regex to match the password failures messages in the logfile.
++# Values:  TEXT  Default:
++#
++failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
++
++
+ [Apache]
+ # Option:  enabled
+ # Notes.:  enable monitoring for this section.
+diff -urNad 0.6.1-8~/config/fail2ban.conf.shorewall 0.6.1-8/config/fail2ban.conf.shorewall
+--- 0.6.1-8~/config/fail2ban.conf.shorewall	2007-02-22 21:06:31.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.shorewall	2007-02-22 21:06:31.000000000 -0500
+@@ -209,6 +209,46 @@
+ # failregex.
+ 
+ 
 +[SASL]
 +# Option:  enabled
 +# Notes.:  enable monitoring for this section.
diff --git a/0.6.1-8/debian/patches/03_failregexes.dpatch b/0.6.1-8/debian/patches/03_failregexes.dpatch
new file mode 100755
index 00000000..c96f5d83
--- /dev/null
+++ b/0.6.1-8/debian/patches/03_failregexes.dpatch
@@ -0,0 +1,43 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 03_failregexes.dpatch by Yaroslav Halchenko <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad 0.6.1-8~/config/fail2ban.conf.hostsdeny 0.6.1-8/config/fail2ban.conf.hostsdeny
+--- 0.6.1-8~/config/fail2ban.conf.hostsdeny	2007-02-22 19:49:33.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.hostsdeny	2007-02-22 21:14:08.000000000 -0500
+@@ -248,7 +248,7 @@
+ # Notes.:  regex to match the password failure messages in the logfile.
+ # Values:  TEXT  Default:  authentication failure|user .* not found
+ #
+-failregex = authentication failure|user .* not found
++failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+ 
+ 
+ [VSFTPD]
+@@ -324,4 +324,4 @@
+ # Notes.:  regex to match the password failures messages in the logfile.
+ # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+ #
+-failregex = Authentication failure|Failed password|Invalid user
++failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
+diff -urNad 0.6.1-8~/config/fail2ban.conf.shorewall 0.6.1-8/config/fail2ban.conf.shorewall
+--- 0.6.1-8~/config/fail2ban.conf.shorewall	2007-02-22 19:49:33.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.shorewall	2007-02-22 21:14:08.000000000 -0500
+@@ -242,7 +242,7 @@
+ # Notes.:  regex to match the password failure messages in the logfile.
+ # Values:  TEXT  Default:  authentication failure|user .* not found
+ #
+-failregex = authentication failure|user .* not found
++failregex = [[]client (?P<host>\S*)[]] user .*(?:: authentication failure|not found)
+ 
+ [VSFTPD]
+ # Option: enabled
+@@ -311,4 +311,4 @@
+ # Notes.:  regex to match the password failures messages in the logfile.
+ # Values:  TEXT  Default:  Authentication failure|Failed password|Invalid user
+ #
+-failregex = Authentication failure|Failed password|Invalid user
++failregex = : (?:(?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid) user)?|[Ii](?:llegal|nvalid) user|ROOT LOGIN REFUSED) .*(?: from|FROM) (?:::f{4,6}:)?(?P<host>\S*)
diff --git a/0.6.1-8/debian/patches/04_iptables-n.dpatch b/0.6.1-8/debian/patches/04_iptables-n.dpatch
new file mode 100755
index 00000000..e9cbb974
--- /dev/null
+++ b/0.6.1-8/debian/patches/04_iptables-n.dpatch
@@ -0,0 +1,19 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 04_iptables-n.dpatch by Yaroslav Halchenko <debian@onerussian.com>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad 0.6.1-8~/config/fail2ban.conf.iptables 0.6.1-8/config/fail2ban.conf.iptables
+--- 0.6.1-8~/config/fail2ban.conf.iptables	2007-02-22 21:15:49.000000000 -0500
++++ 0.6.1-8/config/fail2ban.conf.iptables	2007-02-22 21:17:07.000000000 -0500
+@@ -153,7 +153,7 @@
+ # Notes.:  command executed once before each fwban command
+ # Values:  CMD  Default:
+ #
+-fwcheck = iptables -L %(fwchain)s | grep -q fail2ban-%(__name__)s
++fwcheck = iptables -n -L %(fwchain)s | grep -q fail2ban-%(__name__)s
+ 
+ # Option:  fwban
+ # Notes.:  command executed when banning an IP. Take care that the