mirror of
https://github.com/fail2ban/fail2ban.git
synced 2026-03-11 08:55:31 +00:00
When using Dovecot authentication for Exim, which is relatively common, the current regex for catching authentication failures needs a small tweak. The current plain|login options are too limiting and will only work in the cases when only the Exim's rudimentary built-in authentication is used. There can be not only the dovecot_login shown in this log example, but also dovecot_plain, ntlm, cram, cyrus, md5, and plenty of others. In fact many admins may opt for their own authentication labels, when setting up Exim. For this reason the regex should catch any label. I suggest modifying the regex in the following way: <pre>^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$</pre> |
||
|---|---|---|
| .. | ||
| config | ||
| files | ||
| __init__.py | ||
| actionstestcase.py | ||
| actiontestcase.py | ||
| banmanagertestcase.py | ||
| clientreadertestcase.py | ||
| datedetectortestcase.py | ||
| dummyjail.py | ||
| failmanagertestcase.py | ||
| filtertestcase.py | ||
| misctestcase.py | ||
| samplestestcase.py | ||
| servertestcase.py | ||
| sockettestcase.py | ||
| utils.py | ||