Re: [Fail2ban-users] Postfix Sasl.

[Steven H. <ste...@hi...>]

On 27/01/14 19:40, Wilmer Arambula wrote:
> Good afternoon I have the following problem in log maillog, I have many
> authentication attempts and not fail2ban bans.
>
Appears your log lines should be matching, as there certainly doesn't 
appear to be anything incorrect below. Best bet would be to set 
loglevel=4 in /etc/fail2ban/fail2ban.conf and then restart fail2ban. 
Then post to pastebin, or the like, a copy of the logs lines produced in 
the fail2ban log file, and email a link to the list.
> Maillog:
>
> Jan 27 14:52:31 cjtterabyte postfix/smtpd[23925]: warning:
> s15424879.onlinehome-server.com
> <http://s15424879.onlinehome-server.com>[74.208.9.216]: SASL LOGIN
> authentication failed: authentication failure
> Jan 27 14:52:31 cjtterabyte postfix/smtpd[23925]: lost connection after
> AUTH from s15424879.onlinehome-server.com
> <http://s15424879.onlinehome-server.com>[74.208.9.216]
> Jan 27 14:52:31 cjtterabyte postfix/smtpd[23925]: disconnect from
> s15424879.onlinehome-server.com
> <http://s15424879.onlinehome-server.com>[74.208.9.216]
>
> postfix-sasl.conf:
>
> [INCLUDES]
>
> before = common.conf
>
> [Definition]
>
> _daemon = postfix/smtpd
>
> failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL
> (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [
> A-Za-z0-9+/]*={0,2})?\s*$
>
> # Author: Yaroslav Halchenko
>
> Someone could help me if the filter is well
>
> Regards,
> --
> *Wilmer Arambula. *
> *Asoc. Cooperativa Tecnologia Terabyte 124, RL.
>
> *
>
> **
> **
>
>
>
> ------------------------------------------------------------------------------
> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> Learn Why More Businesses Are Choosing CenturyLink Cloud For
> Critical Workloads, Development Environments & Everything In Between.
> Get a Quote or Start a Free Trial Today.
> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>
>
>
> _______________________________________________
> Fail2ban-users mailing list
> Fai...@li...
> https://lists.sourceforge.net/lists/listinfo/fail2ban-users
>


-- 
Steven Hiscocks