grooverdan/fail2ban — pull request #4 by truxoft (2014-01-13 00:26:06+00:00)
Title: Update exim

When using Dovecot authentication for Exim, which is relatively common, the current regex for catching authentication failures needs a small tweak. The current plain|login options are far too limiting and will only work in cases when only the Exim's rudimentary built-in authentication is used. There can be not only the dovecot_login authenticator name shown in this log example, but also dovecot_plain, ntlm, cram, cyrus, md5, and plenty of others. In fact many admins may opt for their own authentication labels, when setting up Exim. This is not something firmly given. I suggest modifying the failregex line for the authentication in the following way:

^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$

PS: I am sorry I did not yet have time for studying the workflow here, so am not sure whether I can simply go and edit the code in my own branch, or whether I have to do first other steps. However, the suggested modification is rather trivial, so perhaps someone can fix it quickly.