Difference between revisions of "Courier"

From Fail2ban
Jump to: navigation, search
Line 9: Line 9:
  
 
{{Failregex}}
 
{{Failregex}}
 
+
Already in courierlogin.conf filter.
 
<pre>
 
<pre>
failregex = (.*) pop3d: LOGIN FAILED (.*) \[<HOST>\]
+
failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$
 
</pre>
 
</pre>
  
 
[[Category:MailServices]]
 
[[Category:MailServices]]

Revision as of 12:31, 24 February 2010

Courier is mail transfer agent (MTA) server that provides ESMTP, IMAP, POP3, SMAP, webmail, and mailing list services with individual components.


courier-pop version 0.59.0

  • Feb 24 10:50:52 servername pop3d: LOGIN FAILED, user=george, ip=[::ffff:59.62.108.99]


Failregex

The regular expressions below are proposed failregex for this software. Multiple regular expressions for failregex will only work with a version of Fail2ban greater than or equal to 0.7.6.

The tag <HOST> in the regular expressions below is just an alias for (?:::f{4,6}:)?(?P<host>\S+). The replacement is done automatically by Fail2ban when adding the regular expression. At the moment, exactly one named group host or <HOST> tag must be present in each regular expression.

Please, before editing this section, propose your changes in the discussion page first. Already in courierlogin.conf filter.

failregex = LOGIN FAILED, .*, ip=\[<HOST>\]$