From 31e90abe572c440e3800802ed7cad414d5e490d8 Mon Sep 17 00:00:00 2001 From: William Hirigoyen Date: Mon, 23 Jan 2023 10:33:07 +0100 Subject: [PATCH] fail2ban: add 'Internal login failure' to Dovecot filter --- CHANGELOG.md | 1 + fail2ban/files/dovecot-evolix.conf | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 60118ebe..c9d203ae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,6 +13,7 @@ The **patch** part changes is incremented if multiple releases happen the same m ### Added * nagios-nrpe: Print pool config path in check_phpfpm_multi output +* fail2ban: add "Internal login failure" to Dovecot filter ### Changed diff --git a/fail2ban/files/dovecot-evolix.conf b/fail2ban/files/dovecot-evolix.conf index e1ef1a3f..5c18fb9f 100644 --- a/fail2ban/files/dovecot-evolix.conf +++ b/fail2ban/files/dovecot-evolix.conf @@ -1,3 +1,3 @@ [Definition] -failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=,.* +failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Internal login failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=,.* ignoreregex =