From 80a511d735b9a40d552d2f160f1a3390551b466a Mon Sep 17 00:00:00 2001
From: yarikoptic <yarikoptic@a942ae1a-1317-0410-a47c-b1dcaea8d605>
Date: Mon, 2 Oct 2006 13:42:36 +0000
Subject: [PATCH] added sections for sasl and proftpd authentications

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/trunk@402 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 config/filter.d/proftpd.conf | 14 ++++++++++++++
 config/filter.d/sasl.conf    | 14 ++++++++++++++
 config/jail.conf             | 17 +++++++++++++++++
 3 files changed, 45 insertions(+)
 create mode 100644 config/filter.d/proftpd.conf
 create mode 100644 config/filter.d/sasl.conf

diff --git a/config/filter.d/proftpd.conf b/config/filter.d/proftpd.conf
new file mode 100644
index 00000000..3254e198
--- /dev/null
+++ b/config/filter.d/proftpd.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 331 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = USER \S+: no such user found from \S* ?\[(?P<host>\S+)\] to \S+\s*$
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
new file mode 100644
index 00000000..3a675fbd
--- /dev/null
+++ b/config/filter.d/sasl.conf
@@ -0,0 +1,14 @@
+# Fail2Ban configuration file
+#
+# Author: Yaroslav Halchenko
+#
+# $Revision: 331 $
+#
+
+[Definition]
+
+# Option: failregex
+# Notes.: regex to match the password failures messages in the logfile.
+# Values: TEXT
+#
+failregex = : warning: [-._\w]+\[(?P<host>[.\d]+)\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
diff --git a/config/jail.conf b/config/jail.conf
index c96dedb5..02c3576a 100644
--- a/config/jail.conf
+++ b/config/jail.conf
@@ -29,6 +29,23 @@ action   = iptables[name=SSH, port=ssh, protocol=tcp]
 logpath  = /var/log/sshd.log
 maxretry = 5
 
+[proftpd-iptables]
+
+enabled  = false
+filter   = proftpd
+action   = iptables[name=ProFTPD, port=ftp, protocol=tcp]
+           mail-whois[name=ProFTPD, dest=yourmail@mail.com]
+logpath  = /var/log/proftpd/proftpd.log
+maxretry = 6
+
+[sasl-iptables]
+
+enabled  = false
+filter   = sasl
+action   = iptables[name=sasl, port=smtp, protocol=tcp]
+           mail-whois[name=sasl, dest=yourmail@mail.com]
+logpath  = /var/log/mail.log
+
 # This one behaves like the previous and sends a report when the jail
 # is stopped.