|
|
|
@ -1,7 +1,7 @@
|
|
|
|
|
diff -up fail2ban-0.9.6/config/filter.d/sendmail-auth.conf.sendmail fail2ban-0.9.6/config/filter.d/sendmail-auth.conf
|
|
|
|
|
--- fail2ban-0.9.6/config/filter.d/sendmail-auth.conf.sendmail 2017-01-06 19:00:12.228687290 -0700
|
|
|
|
|
+++ fail2ban-0.9.6/config/filter.d/sendmail-auth.conf 2017-01-06 19:01:33.991702030 -0700
|
|
|
|
|
@@ -7,12 +7,16 @@ before = common.conf
|
|
|
|
|
diff -up fail2ban-0.10.0/config/filter.d/sendmail-auth.conf.sendmail fail2ban-0.10.0/config/filter.d/sendmail-auth.conf
|
|
|
|
|
--- fail2ban-0.10.0/config/filter.d/sendmail-auth.conf.sendmail 2017-09-20 20:01:34.624748219 -0600
|
|
|
|
|
+++ fail2ban-0.10.0/config/filter.d/sendmail-auth.conf 2017-09-20 20:02:56.902880330 -0600
|
|
|
|
|
@@ -7,7 +7,7 @@ before = common.conf
|
|
|
|
|
|
|
|
|
|
[Definition]
|
|
|
|
|
|
|
|
|
@ -10,24 +10,3 @@ diff -up fail2ban-0.9.6/config/filter.d/sendmail-auth.conf.sendmail fail2ban-0.9
|
|
|
|
|
|
|
|
|
|
failregex = ^%(__prefix_line)s\w{14}: (\S+ )?\[<HOST>\]( \(may be forged\))?: possible SMTP attack: command=AUTH, count=\d+$
|
|
|
|
|
|
|
|
|
|
ignoreregex =
|
|
|
|
|
|
|
|
|
|
+[Init]
|
|
|
|
|
+
|
|
|
|
|
+journalmatch = _SYSTEMD_UNIT=sendmail.service
|
|
|
|
|
+
|
|
|
|
|
# DEV Notes:
|
|
|
|
|
#
|
|
|
|
|
# Author: Daniel Black
|
|
|
|
|
diff -up fail2ban-0.9.6/config/filter.d/sendmail-reject.conf.sendmail fail2ban-0.9.6/config/filter.d/sendmail-reject.conf
|
|
|
|
|
--- fail2ban-0.9.6/config/filter.d/sendmail-reject.conf.sendmail 2017-01-06 19:00:12.229687303 -0700
|
|
|
|
|
+++ fail2ban-0.9.6/config/filter.d/sendmail-reject.conf 2017-01-06 19:00:12.229687303 -0700
|
|
|
|
|
@@ -33,6 +33,8 @@ ignoreregex =
|
|
|
|
|
|
|
|
|
|
[Init]
|
|
|
|
|
|
|
|
|
|
+journalmatch = _SYSTEMD_UNIT=sendmail.service
|
|
|
|
|
+
|
|
|
|
|
# "maxlines" is number of log lines to buffer for multi-line regex searches
|
|
|
|
|
maxlines = 10
|
|
|
|
|
|
|
|
|
|