From 7ede1e85187764caec77512146f69c76f0621d28 Mon Sep 17 00:00:00 2001
From: hamilton5 <ham5@tehwebz.net>
Date: Mon, 10 Dec 2012 19:17:04 -0500
Subject: [PATCH] Update config/filter.d/dovecot.conf

added failregex line for debian and centos per
http://www.fail2ban.org/wiki/index.php/Talk:Dovecot
---
 config/filter.d/dovecot.conf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/config/filter.d/dovecot.conf b/config/filter.d/dovecot.conf
index 153b9bb0..f37dc892 100644
--- a/config/filter.d/dovecot.conf
+++ b/config/filter.d/dovecot.conf
@@ -15,6 +15,7 @@
 # Values:  TEXT
 #
 failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
+            pam.*dovecot.*(?:authentication failure).*rhost=(?:::f{4,6}:)?(?P<host>\S*) 
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.