fail2ban/fail2ban — pull request #586 by truxoft (2014-01-14 17:04:18+00:00)
Title: BF Dovecot auth failures

I am sorry, I installed the Win GIT, but still did not learn how to work with it, so am posting here again. This time, I'll avoid posting two pull requests, so please fix the dovecot.filter for me, if you don't mind.

The current filter does not match authentication errors in my Dovecot logs (two different lines attached). First of all, the session string is at the end (after the optional TLS string), and not in front of it, as it is now in the filter. I don't see it anywhere in the other logs here, in the opposite order, hence I assume it is the rule for all installations. And then, the session ID can include also other characters than those matched by \w+ (i.e. the slash and the plus signs in my case), hence it needs to be \S+ instead. Personally, I'd do the regex much simpler and less restrictive than it is, but if I follow the current logics, the following form works:

^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((no auth attempts|auth failed, \d+ attempts)( in \d+ secs)?|tried to use disabled \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>, lip=(\d{1,3}\.){3}\d{1,3}(, TLS( handshaking)?(: Disconnected)?)?(, session=<\S+>)?\s*$