On 01.12.2019 1:46, Demetri A. Mkobaranov wrote:
On 11/30/19 6:56 PM, Reio Remma wrote:

I made a filter for myself to log failed auth attempts with IP to use in fail2ban.
do you mean a fail2ban filter?


It's a reporter filter in OpenSMTPD that gathers IP addresses for failed auth and then writes them to maillog:

Nov 27 01:02:26 host smtpd[29787]: auth-reporter: failed authentication from user=username address=113.172.130.229 host=static.vnpt.vn

Fail2ban takes it from there.


Reply via email to