Tom Hendrikx wrote:
> Please show us 3 things:
> - the fail2ban filter config file you are using
> - a log snippet that contains hits for both Regex and IgnoreRegex as set
> in the above config file
> - the commandline you use to test all of this, and which demonstrates
> your problem
>
>
Tom-
Thanks for your reply.
Here's the contents of the fail2ban config file that I'm testing:
[Definition]
failregex = rblsmtpd: <HOST> .*: 451 Blocked
CHKUSER rejected relaying: from <.*:> remote <.*:.*:<HOST>>
rcpt <.*> : client not allowed to relay
CHKUSER rejected rcpt: from <.*:> remote <.*:.*:<HOST>> rcpt
<.*> : not existing recipient
.* rblsmtpd: <HOST>
ignoreregex = exch\.example\.local
10\.0\.0\.79
Here's content from the log file:
@400000004eaace713b735664 tcpserver: status: 1/100
@400000004eaace713b73815c tcpserver: pid 25911 from 10.0.0.79
@400000004eaace713b7394e4 tcpserver: ok 25911
smtp.example.com:10.10.10.6:25 exch.example.local:10.0.0.79::49737
@400000004eaace7710ad7a54 CHKUSER rejected relaying: from <::> remote
<exchext.example.com:exch.example.local:10.0.0.79> rcpt
<Example.OnTime.Automated.Reply@...> : client not allowed
to relay
@400000004eaace7810b86f04 spamdyke[25911]: FILTER_OTHER response: "553
sorry, that domain isn't in my list of allowed rcpthosts (#5.5.3 - chkuser)"
@400000004eaace7810b899fc spamdyke[25911]: DENIED_OTHER from: (unknown)
to: example.ontime.automated.reply@... origin_ip: 10.0.0.79
origin_rdns: exch.example.local auth: (unknown) encryption: (none)
@400000004eaace7812d0d754 CHKUSER rejected relaying: from <::> remote
<exchext.example.com:exch.example.local:10.0.0.79> rcpt
<Example.OnTime.Automated.Reply@...> : client not allowed
to relay
@400000004eaace7924cb9bec spamdyke[25911]: FILTER_OTHER response: "553
sorry, that domain isn't in my list of allowed rcpthosts (#5.5.3 - chkuser)"
@400000004eaace7924cbceb4 spamdyke[25911]: DENIED_OTHER from: (unknown)
to: example.ontime.automated.reply@... origin_ip: 10.0.0.79
origin_rdns: exch.example.local auth: (unknown) encryption: (none)
@400000004eaace7925e76c2c CHKUSER rejected relaying: from <::> remote
<exchext.example.com:exch.example.local:10.0.0.79> rcpt
<Example.OnTime.Automated.Reply@...> : client not allowed
to relay
@400000004eaace7b0e2204e4 spamdyke[25911]: FILTER_OTHER response: "553
sorry, that domain isn't in my list of allowed rcpthosts (#5.5.3 - chkuser)"
@400000004eaace7b0e2204e4 spamdyke[25911]: DENIED_OTHER from: (unknown)
to: example.ontime.automated.reply@... origin_ip: 10.0.0.79
origin_rdns: exch.example.local auth: (unknown) encryption: (none)
@400000004eaace7b0fb00784 CHKUSER rejected relaying: from <::> remote
<exchext.example.com:exch.example.local:10.0.0.79> rcpt
<Example.OnTime.Automated.Reply@...> : client not allowed
to relay
@400000004eaace7d09d02f24 spamdyke[25911]: FILTER_OTHER response: "553
sorry, that domain isn't in my list of allowed rcpthosts (#5.5.3 - chkuser)"
@400000004eaace7d09d05634 spamdyke[25911]: DENIED_OTHER from: (unknown)
to: example.ontime.automated.reply@... origin_ip: 10.0.0.79
origin_rdns: exch.example.local auth: (unknown) encryption: (none)
@400000004eaace7d0a155a2c tcpserver: end 25911 status 0
@400000004eaace7d0a155a2c tcpserver: status: 0/100
Here's the command line for running fail2ban-regex:
$ sudo fail2ban-regex /home/auser/log
/etc/fail2ban/filter.d/qmt-dos-hosts.conf
Here's output:
Running tests
=============
Use regex file : /etc/fail2ban/filter.d/qmt-dos-hosts.conf
Use log file : /home/auser/log
Results
=======
Failregex
|- Regular expressions:
| [1] rblsmtpd: <HOST> .*: 451 Blocked
| [2] CHKUSER rejected relaying: from <.*:> remote <.*:.*:<HOST>> rcpt
<.*> : client not allowed to relay
| [3] CHKUSER rejected rcpt: from <.*:> remote <.*:.*:<HOST>> rcpt <.*>
: not existing recipient
| [4] .* rblsmtpd: <HOST>
|
`- Number of matches:
[1] 0 match(es)
[2] 4 match(es)
[3] 0 match(es)
[4] 0 match(es)
Ignoreregex
|- Regular expressions:
|
`- Number of matches:
Summary
=======
Addresses found:
[1]
[2]
10.0.0.79 (Fri Oct 28 15:47:03 2011)
10.0.0.79 (Fri Oct 28 15:47:04 2011)
10.0.0.79 (Fri Oct 28 15:47:05 2011)
10.0.0.79 (Fri Oct 28 15:47:07 2011)
[3]
[4]
Date template hits:
0 hit(s): MONTH Day Hour:Minute:Second
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second Year
0 hit(s): WEEKDAY MONTH Day Hour:Minute:Second
0 hit(s): Year/Month/Day Hour:Minute:Second
0 hit(s): Day/Month/Year Hour:Minute:Second
0 hit(s): Day/MONTH/Year:Hour:Minute:Second
0 hit(s): Month/Day/Year:Hour:Minute:Second
0 hit(s): Year-Month-Day Hour:Minute:Second
0 hit(s): Day-MONTH-Year Hour:Minute:Second[.Millisecond]
0 hit(s): Day-Month-Year Hour:Minute:Second
72 hit(s): TAI64N
0 hit(s): Epoch
0 hit(s): ISO 8601
0 hit(s): Hour:Minute:Second
0 hit(s): <Month/Day/Year@...>
Success, the total number of match is 4
However, look at the above section 'Running tests' which could contain
important
information.
Brent Gardner
|