From f4c7c8f4b303b8d450ea7a1073fb6ea23b7a186b Mon Sep 17 00:00:00 2001 From: Daniel Black Date: Sat, 5 Oct 2013 18:59:41 +1000 Subject: [PATCH] ENH: sasl - anchor regex at start --- ChangeLog | 1 + config/filter.d/sasl.conf | 20 +++++++------------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/ChangeLog b/ChangeLog index 46b12528..295d7156 100644 --- a/ChangeLog +++ b/ChangeLog @@ -80,6 +80,7 @@ ver. 0.8.11 (2013/XX/XXX) - loves-unittests linux-pam before version 0.99.2.0 (2005) * filter.d/gssftpd - anchored regex at start * filter.d/mysqld-auth.conf - mysql can use syslog + * filter.d/sasl - anchor at start and base on syslog * fail2ban-regex - now generates http://www.debuggex.com urls for debugging regular expressions with the -D parameter. * filter.d/sshd - regex enhancements to support openssh-6.3. Closes Debian diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf index 6c4aeba7..c720abc1 100644 --- a/config/filter.d/sasl.conf +++ b/config/filter.d/sasl.conf @@ -4,19 +4,13 @@ # # +[INCLUDES] + +before = common.conf + [Definition] -# Option: failregex -# Notes.: regex to match the password failures messages in the logfile. The -# host must be matched by a group named "host". The tag "" can -# be used for standard IP/hostname matching and is only an alias for -# (?:::f{4,6}:)?(?P[\w\-.^_]+) -# Values: TEXT -# -failregex = (?i): warning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ +_daemon = postfix/smtpd + +failregex = ^%(__prefix_line)swarning: [-._\w]+\[\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$ -# Option: ignoreregex -# Notes.: regex to ignore. If this regex matches, the line is ignored. -# Values: TEXT -# -ignoreregex =