On Fri, 18 Jul 2014, Pressy wrote:
> actual i can't seemed to reproduce the "authentication failure" - type > message. I'm not sure if this caused by my ldap-backend for user > authentication. > For all the different failure message that cyrus/imaps, I also use a > more complex failregex. > > failregex = ^%(__prefix_line)sbadlogin: \S+ \[<HOST>\] .* (\[|)SASL\(-13\): > > ((generic|authentication) failure|user not found): ((checkpass|Password > > verification) failed|user: .*)(\]|)$ ok -- thanks! - submitting https://github.com/fail2ban/fail2ban/pull/773 note that I have just expanded for "user not found" and not for "generic failure", nor for specific enlisting of reason for failures (there is quite a few and I believe we previously agreed thus just to have .* there which should be ok since <HOST> is anchored nicely upfront review would be most welcome! > Also I noticed that my plain debian stable reports non ssl connections > als cyrus/imap (without the 'd' - see last two lines). So I change the > daemon statement to: > > _daemon = (?:cyrus/)?(?:imap(d|s|)?|pop3(d|s|)?) > I left in the original imapd string even though i can't see it on my > system. Might come up if some configuration are changed. well, (d|s|)? is the same as (d|s)? and actually [ds]? left as (d|s)? for now -- Yaroslav O. Halchenko, Ph.D. http://neuro.debian.net http://www.pymvpa.org http://www.fail2ban.org Research Scientist, Psychological and Brain Sciences Dept. Dartmouth College, 419 Moore Hall, Hinman Box 6207, Hanover, NH 03755 Phone: +1 (603) 646-9834 Fax: +1 (603) 646-1419 WWW: http://www.linkedin.com/in/yarik -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
