fail2ban/fail2ban — pull request #276 by grooverdan (2013-07-01 12:23:14+00:00)
Title: Exim improvements

From some more user submitted logs we have some enhanced regexs.

I've applied a few fixes from #258

local_scan is a binary plugin based add on. I don't think the messages at the end of the regex are predicatable as there could be a few plugins used. I've removed temporary anyway from the ban as that could be misconfigurations or greylisting as mentioned.

> or even better just reject when "local_scan(): Rejected...."? Also then it would help to avoid having .{0,256}. Better too strict than too loose ;)

both have downsides. The regex where the .{0,256} isn't near the >HOST< so I feel quite safe about it.

rbl rejections currently undecided. I've added another form of rbl there. From #259 referencing http://www.zaphinath.com/custom-filter-for-exim-through-fail2ban/ I suspect some of these are very custom configuration to get these. None of the RCPT rejections listed on the blog have log entries provided.