From 882e6d5e0011fe12bac8a356caea0394bc19b26c Mon Sep 17 00:00:00 2001 From: sebres Date: Mon, 10 Feb 2025 17:30:07 +0100 Subject: [PATCH] `filter.d/exim.conf` - mode `aggressive` extended to catch dropped by ACL failures, e.g. "ACL: Country is banned" --- ChangeLog | 1 + config/filter.d/exim.conf | 1 + fail2ban/tests/files/logs/exim | 2 ++ 3 files changed, 4 insertions(+) diff --git a/ChangeLog b/ChangeLog index 4333d52a..f087fbf2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -23,6 +23,7 @@ ver. 1.1.1-dev-1 (20??/??/??) - development nightly edition * `action.d/firewallcmd-ipset.conf`: - rename `ipsettype` to `ipsetbackend` (gh-2620), parameter `ipsettype` will be used now to the real set type (gh-3760) * `filter.d/apache-overflows.conf` - consider AH10244: invalid URI path (gh-3778) +* `filter.d/exim.conf` - mode `aggressive` extended to catch dropped by ACL failures, e.g. "ACL: Country is banned" * `filter.d/freeswitch.conf` - bypass some new info in prefix before [WARNING] (changed default `_pref_line`), FreeSWITCH log line prefix has changed in newer versions (gh-3143) * `filter.d/postfix.conf` - consider CONNECT and other rejected commands as a valid `_pref` (gh-3800) diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index cca32de3..bc36ebf0 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -27,6 +27,7 @@ failregex = ^%(host_info)s sender verify fail for <\S+>: (?:Unknown user|Unroute mdre-aggressive = ^\s?no host name found for IP address $ ^\s?no IP address found for host \S+ \(during SMTP connection from%(host_info)s\)$ + ^%(host_info)s dropped by '[^']+' ACL: mdre-normal = diff --git a/fail2ban/tests/files/logs/exim b/fail2ban/tests/files/logs/exim index 71fc1e26..3bb6c444 100644 --- a/fail2ban/tests/files/logs/exim +++ b/fail2ban/tests/files/logs/exim @@ -120,6 +120,8 @@ 2017-12-03 08:51:35 no IP address found for host test.example.com (during SMTP connection from [192.0.2.9]) # failJSON: { "time": "2022-04-03T21:53:53", "match": true , "host": "63.85.123.6", "desc": "no IP found for host long" } 2022-04-03 21:53:53 no IP address found for host hos-t.example.tld (during SMTP connection from [63.85.123.6]:49390 I=[31.130.202.17]:25) +# failJSON: { "time": "2022-04-03T21:53:54", "match": true , "host": "192.0.2.101", "desc": "dropped by ACL" } +2022-04-03 21:53:54 H=[192.0.2.101]:62839 dropped by 'connect' ACL: Country is banned # filterOptions: {"logtype": "journal"}