← Back to branch summary

~ubuntu-branches/ubuntu/vivid/fail2ban/vivid

« back to all changes in this revision

Viewing changes to config/filter.d/dovecot.conf

  • Committer: Package Import Robot
  • Author(s): Yaroslav Halchenko
  • Date: 2014-03-18 23:13:35 UTC
  • mfrom: (1.2.10)
  • Revision ID: package-import@ubuntu.com-20140318231335-zo2ibn1cfrhl6qzn
Tags: 0.8.13-1
* New upstream bug-fix release: but consider 0.9.0 (to be uploaded to
  experimental)
* debian/jail:
  - new jail definitions: apache-modsecurity, apache-nohome, freeswitch,
    ejabberd-auth, ssh-blocklist, nagios
  - new configuration option: ignorecommand
* debian/post{inst,rm},preinst:
  - [thanks to Daniel Schaal]: take care about renaming config files
    - firewall-cmd-direct-new.conf to firewallcmd-new.conf which happened
      in 0.8.11-29-g56b6bf7
    - lighttpd-fastcgi.conf to suhosin.conf and
      sasl.conf to postfix-sasl.conf in the past 0.8.11 release

Show diffs side-by-side

added added

removed removed

Lines of Context:
config/filter.d/dovecot.conf
10
10
_daemon = (auth|dovecot(-auth)?|auth-worker)
11
11
 
12
12
failregex = ^%(__prefix_line)s(pam_unix(\(dovecot:auth\))?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$
13
 
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, session=<\w+>)?(, TLS( handshaking)?(: Disconnected)?)?\s*$
 
13
            ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$
14
14
            ^%(__prefix_line)s(Info|dovecot: auth\(default\)): pam\(\S+,<HOST>\): pam_authenticate\(\) failed: (User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \(password mismatch\?\))\s*$
15
15
 
16
16
ignoreregex = 
18
18
# DEV Notes:
19
19
# * the first regex is essentially a copy of pam-generic.conf
20
20
# * Probably doesn't do dovecot sql/ldap backends properly
 
21
# * Removed the 'no auth attempts' log lines from the matches because produces
 
22
#    lots of false positives on misconfigured MTAs making regexp unuseable
21
23
#
22
24
# Author: Martin Waschbuesch
23
25
#         Daniel Black (rewrote with begin and end anchors)