On 01.12.2019 1:46, Demetri A. Mkobaranov wrote:
On 11/30/19 6:56 PM, Reio Remma wrote:

I made a filter for myself to log failed auth attempts with IP to use in fail2ban.
do you mean a fail2ban filter?

It's a reporter filter in OpenSMTPD that gathers IP addresses for failed auth and then writes them to maillog:

Nov 27 01:02:26 host smtpd[29787]: auth-reporter: failed authentication from user=username address= host=static.vnpt.vn

Fail2ban takes it from there.

Reply via email to