Difference between revisions of "HOWTO fail2ban with qpopper"
From Fail2ban
Jump to navigationJump to search| Line 19: | Line 19: | ||
\[pop_pass\.c.*\])?$ | \[pop_pass\.c.*\])?$ | ||
ignoreregex = | ignoreregex = | ||
| + | |||
| + | ### | ||
| + | # for strings like | ||
| + | # Oct 16 14:42:00 alpha popper[25364]: anton at 123.234.40.66 (123.234.40.66): -#ERR [AUTH] Password supplied for "anton" is incorrect. [pop_pass.c:1173] | ||
| + | # use | ||
| + | # failregex = \(<HOST>\):\ -ERR\ \[AUTH\] | ||
| + | ### | ||
That should do it! | That should do it! | ||
Revision as of 12:25, 16 October 2008
Configuration for qpopper pop3 daemon is done through the following: (this setup was for openSUSE 10.2)
- First make an entry into your jail.conf file.
[qpopper]
enabled = true
port = pop3
filter = qpopperlogin
action = iptables[name=%(__name__)s, port=%(port)s]
sendmail-whois[name=qpopper, dest=you@mail.com]
logpath = /var/log/mail
maxretry = 5
- Then create a file in filter.d directory called qpopperlogin.conf This failregex statement was sent to the fail2safe mail list by Sven Neukirchner.
[Definition] failregex = popper\[[0-9]+\]: \[AUTH\] Failed attempted login to \S+ from host (\S+) <HOST>(?: \[pop_pass\.c.*\])?$ ignoreregex =
- for strings like
- Oct 16 14:42:00 alpha popper[25364]: anton at 123.234.40.66 (123.234.40.66): -#ERR [AUTH] Password supplied for "anton" is incorrect. [pop_pass.c:1173]
- use
- failregex = \(<HOST>\):\ -ERR\ \[AUTH\]
That should do it!
