| 4 |
- |
1 |
# Fail2Ban filters for qmail RBL patches/fake proxies
|
|
|
2 |
#
|
|
|
3 |
# the default djb RBL implementation doesn't log any rejections
|
|
|
4 |
# so is useless with this filter.
|
|
|
5 |
#
|
|
|
6 |
# One patch is here:
|
|
|
7 |
#
|
|
|
8 |
# http://www.tjsi.com/rblsmtpd/faq/ patch to rblsmtpd
|
|
|
9 |
|
|
|
10 |
[INCLUDES]
|
|
|
11 |
|
|
|
12 |
before = common.conf
|
|
|
13 |
|
|
|
14 |
[Definition]
|
|
|
15 |
|
|
|
16 |
_daemon = (?:qmail|rblsmtpd)
|
|
|
17 |
|
|
|
18 |
failregex = ^%(__prefix_line)s\d+\.\d+ rblsmtpd: <HOST> pid \d+ \S+ 4\d\d \S+\s*$
|
|
|
19 |
^%(__prefix_line)s\d+\.\d+ qmail-smtpd: 4\d\d badiprbl: ip <HOST> rbl: \S+\s*$
|
|
|
20 |
^%(__prefix_line)s\S+ blocked <HOST> \S+ -\s*$
|
|
|
21 |
|
|
|
22 |
ignoreregex =
|
|
|
23 |
|
|
|
24 |
# DEV Notes:
|
|
|
25 |
#
|
|
|
26 |
# These seem to be for two or 3 different patches to qmail or rblsmtpd
|
|
|
27 |
# so you'll probably only ever see one of these regex's that match.
|
|
|
28 |
#
|
|
|
29 |
# ref: https://github.com/fail2ban/fail2ban/pull/386
|
|
|
30 |
#
|
|
|
31 |
# Author: Daniel Black
|