On 09/06/2012 02:04 PM, Mark Felder wrote:
fail2ban's dovecot regex looks like this:failregex = .*(?:pop3-login|imap-login):.*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.*
I see, yes, that's not something you can do with the existing log lines. I'll add a bit to the relevant log calls. Arnt
