diff options
| author | sebres <serg.brester@sebres.de> | 2022-02-09 12:18:23 +0100 |
|---|---|---|
| committer | sebres <serg.brester@sebres.de> | 2022-02-09 12:18:23 +0100 |
| commit | 498e473a10ee56aa6345b03cd3bf83e017df966c (patch) | |
| tree | a7c1aa78b72e1539c1549a2d1817655244373713 /config | |
| parent | 8013cf0b900f2cacfdc1c9152c9b9847bfc41877 (diff) | |
| download | fail2ban-498e473a10ee56aa6345b03cd3bf83e017df966c.tar.gz | |
filter.d/courier-auth.conf: consider optional port after IP, regex is rewritten without catch-all's and right anchor, so it is more stable against further modifications now;
closes #3211
Diffstat (limited to 'config')
| -rw-r--r-- | config/filter.d/courier-auth.conf | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/config/filter.d/courier-auth.conf b/config/filter.d/courier-auth.conf index 1ac33736..d5ba9c50 100644 --- a/config/filter.d/courier-auth.conf +++ b/config/filter.d/courier-auth.conf @@ -11,7 +11,7 @@ before = common.conf _daemon = (?:courier)?(?:imapd?|pop3d?)(?:login)?(?:-ssl)? -failregex = ^%(__prefix_line)sLOGIN FAILED, (?:user|method)=.*, ip=\[<HOST>\]$ +failregex = ^%(__prefix_line)sLOGIN FAILED, (?:(?!ip=)(?:user=<F-USER>[^,]*</F-USER>|\w+=[^,]*), )*ip=\[<HOST>\] ignoreregex = |