From 8f0c533d644bfb2316661d2b204658950d0ab37c Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 4 Jan 2013 10:55:14 -0500 Subject: [PATCH 1/2] DOC: Mention that logrotate configuration needs to be adjusted if logtarget is changed (Closes: #697333) --- config/fail2ban.conf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/config/fail2ban.conf b/config/fail2ban.conf index a8e2eb9a..f2f1b215 100644 --- a/config/fail2ban.conf +++ b/config/fail2ban.conf @@ -24,6 +24,10 @@ loglevel = 3 # Option: logtarget # Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT. # Only one log target can be specified. +# If you change logtarget from the default value and you are +# using logrotate -- also adjust or disable rotation in the +# corresponding configuration file +# (e.g. /etc/logrotate.d/fail2ban on Debian systems) # Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log # logtarget = /var/log/fail2ban.log From 3ce53e87984d7abc84ea4d34ded985e31f29d830 Mon Sep 17 00:00:00 2001 From: Yaroslav Halchenko Date: Fri, 4 Jan 2013 15:22:18 -0500 Subject: [PATCH 2/2] ENH: Added login authenticator failed regexp for exim filter --- config/filter.d/exim.conf | 1 + testcases/files/logs/exim | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 testcases/files/logs/exim diff --git a/config/filter.d/exim.conf b/config/filter.d/exim.conf index a25ef3db..8bf4fc5f 100644 --- a/config/filter.d/exim.conf +++ b/config/filter.d/exim.conf @@ -15,6 +15,7 @@ # Values: TEXT # failregex = \[\] .*(?:rejected by local_scan|Unrouteable address) + login authenticator failed for .* \[\]: 535 Incorrect authentication data \(set_id=.*\)\s*$ # Option: ignoreregex # Notes.: regex to ignore. If this regex matches, the line is ignored. diff --git a/testcases/files/logs/exim b/testcases/files/logs/exim new file mode 100644 index 00000000..dd507379 --- /dev/null +++ b/testcases/files/logs/exim @@ -0,0 +1,2 @@ +# From IRC 2013-01-04 +2013-01-04 17:03:46 login authenticator failed for rrcs-24-106-174-74.se.biz.rr.com ([192.168.2.33]) [24.106.174.74]: 535 Incorrect authentication data (set_id=brian)