Subversion Repositories configs

Rev

Rev 6 | Go to most recent revision | Details | Last modification | View Log | RSS feed

Rev Author Line No. Line
3 - 1
# Fail2Ban filter for exim
2
#
3
# This includes the rejection messages of exim. For spam and filter
4
# related bans use the exim-spam.conf
5
#
6
 
7
 
8
[INCLUDES]
9
 
10
# Read common prefixes. If any customizations available -- read them from
11
# exim-common.local
12
before = exim-common.conf
13
 
14
[Definition]
15
 
16
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$
17
             ^%(pid)s (plain|login) authenticator failed for (\S+ )?\(\S+\) \[<HOST>\]: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$
18
             ^%(pid)s %(host_info)sF=(<>|[^@]+@\S+) rejected RCPT [^@]+@\S+: (relay not permitted|Sender verify failed|Unknown user)\s*$
19
             ^%(pid)s SMTP protocol synchronization error \([^)]*\): rejected (connection from|"\S+") %(host_info)s(next )?input=".*"\s*$
20
             ^%(pid)s SMTP call from \S+ \[<HOST>\](:\d+)? (I=\[\S+\]:\d+ )?dropped: too many nonmail commands \(last was "\S+"\)\s*$
21
 
22
ignoreregex =
23
 
24
# DEV Notes:
25
# The %(host_info) defination contains a <HOST> match
26
#
27
# SMTP protocol synchronization error \([^)]*\)  <- This needs to be non-greedy
28
# to void capture beyond ")" to avoid a DoS Injection vulnerabilty as input= is
29
# user injectable data.
30
#
31
# Author: Cyril Jaquier
32
#         Daniel Black (rewrote with strong regexs)