From 35bf84abadfc633e33a36bdcb32586f652fdadf3 Mon Sep 17 00:00:00 2001
From: ArndRa <ArndRaphael.Brandes@gmx.de>
Date: Mon, 11 Feb 2013 08:19:48 -0800
Subject: [PATCH] Create sogo-auth.conf

Regexp works with SOGo 2.0.5 or newer, following new feature implemented here: http://www.sogo.nu/bugs/view.php?id=2229
---
 config/filter.d/sogo-auth.conf | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 config/filter.d/sogo-auth.conf

diff --git a/config/filter.d/sogo-auth.conf b/config/filter.d/sogo-auth.conf
new file mode 100644
index 00000000..e4d29c23
--- /dev/null
+++ b/config/filter.d/sogo-auth.conf
@@ -0,0 +1,19 @@
+# /etc/fail2ban/filter.d/sogo.conf
+#
+# Fail2Ban configuration file
+# By Arnd Brandes
+# SOGo
+#
+
+[Definition]
+# Option: failregex
+# Filter Ban in /var/log/sogo/sogo.log
+# Note: the error log may contain multiple hosts, whereas the first one 
+# is the client and all others are poxys. We match the first one, only
+
+failregex = Login from '<HOST>.*' for user '.*' might not have worked
+
+# Option: ignoreregex
+# Notes.: regex to ignore. If this regex matches, the line is ignored.
+# Values: TEXT
+#