Skip to content

Instantly share code, notes, and snippets.

@toniher
Created April 18, 2021 10:22
Show Gist options
  • Save toniher/67000f5be18e83e633af8fedf7a5dd99 to your computer and use it in GitHub Desktop.
Save toniher/67000f5be18e83e633af8fedf7a5dd99 to your computer and use it in GitHub Desktop.
dovecot-custom.conf for fail2ban
[INCLUDES]
before = common.conf
[Definition]
_auth_worker = (?:dovecot: )?auth(?:-worker)?
_daemon = (?:dovecot(?:-auth)?|auth)
prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap)-login: )?(?:Error: )?<F-CONTENT>.+</F-CONTENT>$
failregex = ^login\(\S*,<HOST>(?:,\S*)?\):
# This should block:
# Apr 18 10:19:18 myhost dovecot: auth: Error: login(abcde@xxx.yyy,aa.bb.cc.dd): Request 0.15 timed out after 226 secs, state=1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment