Dan,

I have it working showing the IP address:

In /etc/fail2ban/jail.conf:

# squirrelmail
[squirrelmail-iptables]
enabled  = true
filter   = squirrelmail
action   = iptables[name=SquirrelMail, port=http, protocol=tcp]
           sendmail-squirrelmail[name=SquirrelMail,dest=ab...@carlc.com, 
sender=ab...@carlc.com]
# adjust logpath with Squirrelmail's squirrel_logger plugin log
logpath  = /var/log/squirrelmail.log
maxretry = 5


-----Then in /etc/fail2ban/filter.d/squirrelmail.conf


[Definition]

failregex = ^ \[LOGIN_ERROR\].*from <HOST>: Unknown user or password 
incorrect\.$

ignoreregex =

[Init]

datepattern = ^%%m/%%d/%%Y %%H:%%M:%%S

# DEV NOTES:
#
# Author: Daniel Black

----For sendmail-squirrelmail in /etc/fail2ban/action.d, I copied 
sendmail-whois-lines.conf to sendmail-squirrelmail.conf and changed the very 
last line to:

# Path to the log files which contain relevant lines for the abuser IP
#
logpath = /var/log/squirrelmail.log

I hope this helps...
Carl


---------------------------------------------------------------------
To unsubscribe, e-mail: qmailtoaster-list-unsubscr...@qmailtoaster.com
For additional commands, e-mail: qmailtoaster-list-h...@qmailtoaster.com

Reply via email to