From a786e8a29b29748084c6d375d9bfc6e44c71e0d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sz=C3=A9pe=20Viktor?= Date: Sun, 20 Jul 2014 19:59:54 +0200 Subject: [PATCH 1/5] named users + smtp atuh probes --- config/filter.d/courier-smtp.conf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/filter.d/courier-smtp.conf b/config/filter.d/courier-smtp.conf index 2b9a13f2..7a3b9895 100644 --- a/config/filter.d/courier-smtp.conf +++ b/config/filter.d/courier-smtp.conf @@ -12,7 +12,8 @@ before = common.conf _daemon = courieresmtpd -failregex = ^%(__prefix_line)serror,relay=,.*: 550 User unknown\.$ +failregex = ^%(__prefix_line)serror,relay=,.*: 550 User (<.*> )?unknown(\.)?$ + ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd: (AUTH PLAIN )?[0-9a-zA-Z\+/=]+$ ignoreregex = From d757ef584f7928086f439da5653031019eeb4110 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sz=C3=A9pe=20Viktor?= Date: Sun, 20 Jul 2014 21:09:10 +0200 Subject: [PATCH 2/5] Update courier-smtp.conf --- config/filter.d/courier-smtp.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/courier-smtp.conf b/config/filter.d/courier-smtp.conf index 7a3b9895..9447de40 100644 --- a/config/filter.d/courier-smtp.conf +++ b/config/filter.d/courier-smtp.conf @@ -13,7 +13,7 @@ before = common.conf _daemon = courieresmtpd failregex = ^%(__prefix_line)serror,relay=,.*: 550 User (<.*> )?unknown(\.)?$ - ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd: (AUTH PLAIN )?[0-9a-zA-Z\+/=]+$ + ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$ ignoreregex = From 9c4f9a3de8c2394a2f098365756c6d0853727366 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sz=C3=A9pe=20Viktor?= Date: Sun, 20 Jul 2014 21:13:55 +0200 Subject: [PATCH 3/5] added Jul 3 & Jul 4 --- fail2ban/tests/files/logs/courier-smtp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fail2ban/tests/files/logs/courier-smtp b/fail2ban/tests/files/logs/courier-smtp index 212df3b4..33463bab 100644 --- a/fail2ban/tests/files/logs/courier-smtp +++ b/fail2ban/tests/files/logs/courier-smtp @@ -1,5 +1,9 @@ # failJSON: { "time": "2005-04-10T03:47:57", "match": true , "host": "1.2.3.4" } Apr 10 03:47:57 web courieresmtpd: error,relay=::ffff:1.2.3.4,ident=tmf,from=,to=: 550 User unknown. +# failJSON: { "time": "2004-07-03T23:07:20", "match": true , "host": "1.2.3.4" } +Jul 3 23:07:20 szerver courieresmtpd: error,relay=::ffff:1.2.3.4,msg="535 Authentication failed.",cmd: YWRvYmVhZG9iZQ== +# failJSON: { "time": "2004-07-04T18:39:39", "match": true , "host": "1.2.3.4" } +Jul 4 18:39:39 mail courieresmtpd: error,relay=::ffff:1.2.3.4,from=,to=: 550 User unknown # failJSON: { "time": "2005-07-06T03:42:28", "match": true , "host": "1.2.3.4" } Jul 6 03:42:28 whistler courieresmtpd: error,relay=::ffff:1.2.3.4,from=<>,to=: 550 User unknown. # failJSON: { "time": "2004-11-21T23:16:17", "match": true , "host": "1.2.3.4" } From 68bf5a1c3638732a3ef520dc7638eacda2a9b393 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sz=C3=A9pe=20Viktor?= Date: Sun, 20 Jul 2014 21:23:57 +0200 Subject: [PATCH 4/5] I don't understand those years. --- fail2ban/tests/files/logs/courier-smtp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fail2ban/tests/files/logs/courier-smtp b/fail2ban/tests/files/logs/courier-smtp index 33463bab..7beaf856 100644 --- a/fail2ban/tests/files/logs/courier-smtp +++ b/fail2ban/tests/files/logs/courier-smtp @@ -1,8 +1,8 @@ # failJSON: { "time": "2005-04-10T03:47:57", "match": true , "host": "1.2.3.4" } Apr 10 03:47:57 web courieresmtpd: error,relay=::ffff:1.2.3.4,ident=tmf,from=,to=: 550 User unknown. -# failJSON: { "time": "2004-07-03T23:07:20", "match": true , "host": "1.2.3.4" } +# failJSON: { "time": "2005-07-03T23:07:20", "match": true , "host": "1.2.3.4" } Jul 3 23:07:20 szerver courieresmtpd: error,relay=::ffff:1.2.3.4,msg="535 Authentication failed.",cmd: YWRvYmVhZG9iZQ== -# failJSON: { "time": "2004-07-04T18:39:39", "match": true , "host": "1.2.3.4" } +# failJSON: { "time": "2005-07-04T18:39:39", "match": true , "host": "1.2.3.4" } Jul 4 18:39:39 mail courieresmtpd: error,relay=::ffff:1.2.3.4,from=,to=: 550 User unknown # failJSON: { "time": "2005-07-06T03:42:28", "match": true , "host": "1.2.3.4" } Jul 6 03:42:28 whistler courieresmtpd: error,relay=::ffff:1.2.3.4,from=<>,to=: 550 User unknown. From 143a55bf26de76ecac332f43c03cd9542e2ccd48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sz=C3=A9pe=20Viktor?= Date: Mon, 28 Jul 2014 12:51:38 +0200 Subject: [PATCH 5/5] Update courier-smtp.conf --- config/filter.d/courier-smtp.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/filter.d/courier-smtp.conf b/config/filter.d/courier-smtp.conf index 9447de40..7df385bf 100644 --- a/config/filter.d/courier-smtp.conf +++ b/config/filter.d/courier-smtp.conf @@ -12,7 +12,7 @@ before = common.conf _daemon = courieresmtpd -failregex = ^%(__prefix_line)serror,relay=,.*: 550 User (<.*> )?unknown(\.)?$ +failregex = ^%(__prefix_line)serror,relay=,.*: 550 User (<.*> )?unknown\.?$ ^%(__prefix_line)serror,relay=,msg="535 Authentication failed\.",cmd:( AUTH \S+)?( [0-9a-zA-Z\+/=]+)?$ ignoreregex =