On 2021-10-18 07:39, Krzysztof Adamski wrote: >> Oct 17 16:33:34 mailserver dovecot: auth-worker(41189): conn >> unix:auth- >> worker (pid=41188,uid=108): auth-worker<119>: >> sql(orders,219.145.118.23,<tABXVZLOhpnbkXYX>): unknown user (given >> password: qwer1234) >> >> > I was wrong, the auth-worker failures are not being used in the ban. Is > there anything I can change to enable the ban on this?
failregex = ^.*auth\-worker\(.*sql\(.*,<HOST>,.*\)\: unknown user .* -- James Moe moe dot james at sohnen-moe dot com 520.743.3936 Think. _______________________________________________ Fail2ban-users mailing list Fail2ban-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/fail2ban-users
