Hi Eric S.
I'm catching Imap attempts in my dovecot.log file - I have a
dovecot.conf filter in fail2ban that catches faulty attempts + a
squirrelmail filter.
Below is a not yet very readable dovecot-imap.conf filter - When time
permits I will try to make it more readable and / or make some comments
so I will be able to myself remember what it does (ol' man I am).
failregex = (?:pop3|imap)-login: Info: (?:Authentication failure|Aborted
login \
(auth failed|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
(?:imap|pop3)-login: Info: Disconnected: user=<.*>,
method=(?:LOGIN|
PLAIN|(?:CRAM|DIGEST)-MD5), rip=(?P<host>\S*), lip
(?:imap|pop3)-login: Info: Aborted login.*user=<.*>,
.*rip=(?P<host>
\S*),.*
(?:imap|pop3)-login: Info: Disconnected: user=<.*>,
method=(?:LOGIN|
PLAIN|(?:CRAM|DIGEST)), rip=(?P<host>\S*), lip
Regards,
Finn
On 12-03-2011 15:32, Eric Shubert wrote:
That looks fine indeed, Finn. I'm fond of readability. :)
What about IMAP? I know it's not used as much as the others, but it
could be an attractive target to some evil-doers.
---------------------------------------------------------------------------------
Qmailtoaster is sponsored by Vickers Consulting Group
(www.vickersconsulting.com)
Vickers Consulting Group offers Qmailtoaster support and installations.
If you need professional help with your setup, contact them today!
---------------------------------------------------------------------------------
Please visit qmailtoaster.com for the latest news, updates, and packages.
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
