From Fail2ban
Jump to: navigation, search

XMail is an Internet and intranet mail server featuring an ESMTP server, POP3 server, finger server, TLS support for SMTP and POP3 (both server and client side), multiple domains, no need for users to have a real system account, SMTP relay checking, DNS based maps check, custom (IP based and address based) spam protection, SMTP authentication (PLAIN LOGIN CRAM-MD5 POP3-before-SMTP and custom), a POP3 account syncronizer with external POP3 accounts, account aliases, domain aliases, custom mail processing, direct mail files delivery, custom mail filters, mailing lists, remote administration, custom mail exchangers, logging, and multi-platform code. XMail sources compile under GNU/Linux, FreeBSD, OpenBSD, NetBSD, OSX, Solaris and NT/2K/XP.

Following adds protection for the Xmail SMTP server only.

Xmail 1.24 ESMTP Server

"mydomain.com" "mydomain.com" "" "2008-11-16 19:00:26" "example.com" "" "" "" "" "AUTH=EFAIL:TYPE=CRAM-MD5" "" "0" ""

"mydomain.com" "mydomain.com" "" "2008-11-16 21:15:01" "example.com" "" "" "" "" "AUTH=EFAIL:TYPE=LOGIN" "" "0" ""

...where aka example.com is the offending host.


The regular expressions below are proposed failregex for this software. Multiple regular expressions for failregex will only work with a version of Fail2ban greater than or equal to 0.7.6.

The tag <HOST> in the regular expressions below is just an alias for (?:::f{4,6}:)?(?P<host>\S+). The replacement is done automatically by Fail2ban when adding the regular expression. At the moment, exactly one named group host or <HOST> tag must be present in each regular expression.

Please, before editing this section, propose your changes in the discussion page first.

failregex = ".*"	".*"	"<HOST>"	".*"	".*"	".*"	".*"	".*"	".*"	"AUTH=EFAIL.*"	".*"	".*"	".*"