From 4bb8a58dcf19ba8cdef9af6fd81b5da3bb3490ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Fri, 28 Apr 2017 15:49:59 +0200 Subject: [PATCH 1/5] Courier may complain about the method only > Mar 30 22:29:18 szerver imapd-ssl: LOGIN FAILED, method=PLAIN, ip=[::ffff:1.2.3.4] --- config/filter.d/courier-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/courier-auth.conf b/config/filter.d/courier-auth.conf index 87ee55b4..9df74994 100644 --- a/config/filter.d/courier-auth.conf +++ b/config/filter.d/courier-auth.conf @@ -11,7 +11,7 @@ before = common.conf _daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)? -failregex = ^%(__prefix_line)sLOGIN FAILED, user=.*, ip=\[\]$ +failregex = ^%(__prefix_line)sLOGIN FAILED, (user|method)=.*, ip=\[\]$ ignoreregex = From ac256a822b5ecc2758fabe86ec643363f3b2913a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Fri, 28 Apr 2017 16:58:24 +0200 Subject: [PATCH 2/5] Make courier-auth regexp a non-captured group --- config/filter.d/courier-auth.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/courier-auth.conf b/config/filter.d/courier-auth.conf index 9df74994..1ac33736 100644 --- a/config/filter.d/courier-auth.conf +++ b/config/filter.d/courier-auth.conf @@ -11,7 +11,7 @@ before = common.conf _daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)? -failregex = ^%(__prefix_line)sLOGIN FAILED, (user|method)=.*, ip=\[\]$ +failregex = ^%(__prefix_line)sLOGIN FAILED, (?:user|method)=.*, ip=\[\]$ ignoreregex = From 1ed958521c4bd6ba54816a4a80136218e7c78457 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Fri, 28 Apr 2017 17:08:36 +0200 Subject: [PATCH 3/5] Courier auth changelog --- ChangeLog | 1 + 1 file changed, 1 insertion(+) diff --git a/ChangeLog b/ChangeLog index 2c3e91ab..c1921da4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -97,6 +97,7 @@ TODO: implementing of options resp. other tasks from PR #1346 e. g. by unban all, reload with removing action, stop, shutdown the system (gh-1743), the actions having `actionflush` do not execute `actionunban` for each single ticket * add new command `actionflush` default for several iptables/iptables-ipset actions (and common include); +* support Courier failed logins with method only ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc From eb5c75e4b5c73dc126da72a18827eaf029bd813f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Viktor=20Sz=C3=A9pe?= Date: Sat, 29 Apr 2017 17:12:15 +0200 Subject: [PATCH 4/5] Add test to Courier auth --- fail2ban/tests/files/logs/courier-auth | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fail2ban/tests/files/logs/courier-auth b/fail2ban/tests/files/logs/courier-auth index e3d0d8c3..3505e109 100644 --- a/fail2ban/tests/files/logs/courier-auth +++ b/fail2ban/tests/files/logs/courier-auth @@ -6,3 +6,5 @@ Apr 23 21:59:38 dns2 pop3d: LOGIN FAILED, user=info@example.com, ip=[::ffff:198. Nov 13 08:11:53 server imapd-ssl: LOGIN FAILED, user=user@domain.tld, ip=[::ffff:198.51.100.33] # failJSON: { "time": "2005-04-17T19:17:11", "match": true , "host": "1.2.3.4" } Apr 17 19:17:11 SERVER courierpop3login: LOGIN FAILED, user=USER@EXAMPLE.org, ip=[::ffff:1.2.3.4] +# failJSON: { "time": "2005-04-17T19:17:12", "match": true , "host": "192.0.2.4" } +Apr 17 19:17:12 server imapd-ssl: LOGIN FAILED, method=PLAIN, ip=[::ffff:192.0.2.4] From b5d59e888377cb33cda7607f0a670c2930f82924 Mon Sep 17 00:00:00 2001 From: "Serg G. Brester" Date: Tue, 2 May 2017 16:59:05 +0200 Subject: [PATCH 5/5] small fix of changelog entry --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index c1921da4..d5044590 100644 --- a/ChangeLog +++ b/ChangeLog @@ -97,7 +97,7 @@ TODO: implementing of options resp. other tasks from PR #1346 e. g. by unban all, reload with removing action, stop, shutdown the system (gh-1743), the actions having `actionflush` do not execute `actionunban` for each single ticket * add new command `actionflush` default for several iptables/iptables-ipset actions (and common include); -* support Courier failed logins with method only +* filter.d/courier-auth.conf: support failed logins with method only ver. 0.10.0-alpha-1 (2016/07/14) - ipv6-support-etc