Dan,
I have it working showing the IP address:
In /etc/fail2ban/jail.conf:
# squirrelmail
[squirrelmail-iptables]
enabled = true
filter = squirrelmail
action = iptables[name=SquirrelMail, port=http, protocol=tcp]
sendmail-squirrelmail[name=SquirrelMail,[email protected],
[email protected]]
# adjust logpath with Squirrelmail's squirrel_logger plugin log
logpath = /var/log/squirrelmail.log
maxretry = 5
-----Then in /etc/fail2ban/filter.d/squirrelmail.conf
[Definition]
failregex = ^ \[LOGIN_ERROR\].*from <HOST>: Unknown user or password
incorrect\.$
ignoreregex =
[Init]
datepattern = ^%%m/%%d/%%Y %%H:%%M:%%S
# DEV NOTES:
#
# Author: Daniel Black
----For sendmail-squirrelmail in /etc/fail2ban/action.d, I copied
sendmail-whois-lines.conf to sendmail-squirrelmail.conf and changed the very
last line to:
# Path to the log files which contain relevant lines for the abuser IP
#
logpath = /var/log/squirrelmail.log
I hope this helps...
Carl
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
