Oh, maybe it was all those auth failed messages
On July 12, 2018 10:30:47 AM CEST, Sophie Loewenthal
wrote:
>Hi Nick,
>
>Here you go. domain name/users have been obfuscated.
>
>
>Running tests
>=
>
>Use failregex filter file : dovecot, basedir: /et
Morning,
A new K9 Mail client gets banned all the time and I am trying to work
out why.
I have this regex:
failregex = auth:.+dovecot:auth.+authentication\s+failure;.+rhost=
dovecot:.+rip=.+wrong version number
dovecot:.+tried to use disallowed plaintext auth.+rip=
l-missed to print all 6117
lines
> On 12 Jul 2018, at 09:50, Nick Howitt wrote:
>
> Sorry. should have replied to list.
>
> Add --print-all-matched to the fail2ban-regex command
>
> On 12/07/2018 07:59, Sophie Loewenthal wrote:
>>
>> Morning,
>>
>
> On 13 Mar 2018, at 23:39, Sophie Loewenthal <sop...@klunky.co.uk> wrote:
>
> Changed it to this in jail.conf and restarted and dovecot jail is not active.
>
> [dovecot]
> enable = true
> port= imap,imaps,sieve
> logpath = %(syslog_mail)s
> backend = %(dovecot
3/13/2018 4:39 PM, Sophie Loewenthal wrote:
>
>> Changed it to this in jail.conf and restarted and dovecot jail is not active.
>
> Side note: you shouldn't use jail.conf, use your own jail.local
> (jail.conf gets overwritten on version update).
>
>> [dovecot]
>
= auth:.+dovecot:auth.+authentication\s+failure;.+rhost=
> dovecot:.+rip=.+wrong version number
> dovecot:.+tried to use disallowed plaintext auth.+rip=
> dovecot:.+auth failed.+rip=
> dovecot:.+no auth attemps.+rip=
>
> Bill
>
don’t think I follow the enabled= logic well :(
Sophie
> On 13 Mar 2018, at 23:30, René Berber <rber...@cactus-soft.org> wrote:
>
> On 3/13/2018 4:25 PM, Sophie Loewenthal wrote:
>
>> Hi Rene, Is this case for everything now? I don’t have an 'enabled = true'
Sorry was sent offlist accidentally. List looped back in.
> On 13 Mar 2018, at 23:25, Sophie Loewenthal <sop...@klunky.co.uk> wrote:
>
> Hi Rene, Is this case for everything now? I don’t have an 'enabled = true'
> for sshd for example and the jail stared.
>
> # grep
ersion you're running
> - contents of the /etc/fail2ban/filter.d/dovecot.conf file, so we can
> extend the current regex
>
> For nginx, please create a new thread and supply the same information,
> along with some sample log lines.
>
> Kind regards,
>
> Tom
>
&
nf file, so we can
> extend the current regex
>
> For nginx, please create a new thread and supply the same information,
> along with some sample log lines.
>
> Kind regards,
>
> Tom
>
>
> On 12-03-18 21:03, Sophie Loewenthal wrote:
>> Hi, Thanks
this
strange that it would unban an IP from before it was enabled.
> On 16 Mar 2018, at 08:37, Sophie Loewenthal <sop...@klunky.co.uk> wrote:
>
> Good morning,
>
> This is interesting ( for me ).
>
> I read this in my logs after enabling postfix-auth on Debi
t;rber...@cactus-soft.org> wrote:
>
> On 3/16/2018 1:37 AM, Sophie Loewenthal wrote:
>
>> fail2ban.log 2018-03-15 19:12:36,066 fail2ban.actions
>> [12742]: ERROR Failed to execute unban jail 'postfix-auth' action
>> 'iptables-multiport' info '{'matches': 'Mar 14 2
Hi guys,
Version: fail2ban 0.10.2-2.1
Just upgraded Debian from 9 to 10. iptables still runs.
Did fail2ban started trying to add strange strings into iptables?
However the 41.113.60.220 IP was removed from iptables and running
fail2ban-client reload gave clean results.
2019-09-04
annoying
> On 24 Feb 2022, at 7:02 pm, Graham B.
> wrote:
>
> On Wed, 23 Feb 2022, Sophie Loewenthal wrote:
>
>> Date: Wed, 23 Feb 2022 09:13:06
>> From: Sophie Loewenthal
>> To: fail2ban-users@lists.sourceforge.net
>> Subject: [Fail2ban-users]
Sorry, I thought you were my brother replying to me! Opps.
Still ;-)
> On 24 Feb 2022, at 7:07 pm, Sophie Loewenthal wrote:
>
> You can't mend it really. It is an annoying message.
>
> I sent an question to the fail2ban mailinglist yesterday, and I am awaiting a
> r
> On 25 Feb 2022, at 7:48 pm, James Moe via Fail2ban-users
> wrote:
>
> On 2022-02-24 11:01, Graham B. wrote:
>
>> I had this message from fail2ban after an upgrade from Debian 9
>> to 10 for many months.
>>
>> How could I mend these jails?
>>
>> ** WARNINGS **
>> [nginx-x1] Please check
Hi,
I had this message from fail2ban after an upgrade from Debian 9 to 10 for many
months.
fail2ban 0.11.2-2
How could I mend these jails?
** WARNINGS **
[nginx-x1] Please check jail has possibly a timezone issue. Line with odd
timestamp: 35.205.35.197 - - [01/Feb/2022:03:10:28 +]
17 matches
Mail list logo
