Please explain in more detail what you want from me

Am 28.04.2013 16:28, schrieb Yaroslav Halchenko:
>
> In config/filter.d/assp.conf:
>
> > +
> > +[Definition]
> > +
> > +# Option:  failregex
> > +# Notes.:  regex to match the SMTP failure messages in the logfile. The
> > +#          host must be matched by a group named "host". The tag "<HOST>" can
> > +#          be used for standard IP/hostname matching and is only an alias for
> > +#          (?:::f{4,6}:)?(?P<host>\S+)
> > +# Values:  TEXT
> > +#
> > +# Examples: Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
> > +#           Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
> > +#           Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded
> > +failregex = <HOST> max sender authentication errors
> > +			<HOST> SSL negotiation with client failed
> > +			Blocking <HOST> - too much AUTH errors
>
> although I do not see obvious injection possibility it is better to be 
> more precise and try to make regular expression more rigid, e.g. we 
> try to anchor it at the end -- please see other filters for inspiration ;)
>
> —
> Reply to this email directly or view it on GitHub 
> <https://github.com/fail2ban/fail2ban/pull/193/files#r3991508>.
>