So do I understand well, that denyhost can catch anything saved in auth.log? Even from dovecot? i.e. this?:
Apr 2 18:31:44 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:44 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:44 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:45 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:46 localhost dovecot-auth: (pam_unix) check pass; user unknown Apr 2 18:31:46 localhost dovecot-auth: (pam_unix) authentication failure; logname= uid=0 euid=0 tty=dovecot ruser= rhost=24. 97.230.106 Apr 2 18:31:46 localhost dovecot-auth: (pam_unix) check pass; user unknown All I have to do is to make good regex? Thank you -- geon Pavel Kosina ------------------------------------------------------------------------- Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source. http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace _______________________________________________ Denyhosts-user mailing list Denyhosts-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/denyhosts-user
