Otdfbt

Why did the AvroCar fail to fly above 3 feet?

A flower's head or heart?

Is it true that "only photographers care about noise"?

Does every chapter have to "blow the reader away" so to speak?

I sent an angry e-mail to my interviewers about a conflict at my home institution. Could this affect my application?

Is it possible to have battery technology that can't be duplicated?

How effective would a full set of plate armor be against wild animals found in temperate regions (bears, snakes, wolves)?

Why did Robert pick unworthy men for the White Cloaks?

Why do the “Shtei HaLechem” not play a prominent part in the davenning for Shavuos?

ISP is not hashing the password I log in with online. Should I take any action?

Realistic, logical way for men with medieval-era weaponry to compete with much larger and physically stronger foes

The best in flight meal option for those suffering from reflux

Can Mage Hand be used to indirectly trigger an attack?

What did the 8086 (and 8088) do upon encountering an illegal instruction?

Interview was just a one hour panel. Got an offer the next day; do I accept or is this a red flag?

Is it possible to install Firefox on Ubuntu with no desktop enviroment?

I received a gift from my sister who just got back from

ifnum expanding too much - what is happening?

What do I need to do, tax-wise, for a sudden windfall?

New Site Design!

How to search for Android apps without ads?

Can a 40amp breaker be used safely and without issue with a 40amp device on 6AWG wire?

Why are backslashes included in this shell script?

Why is gun control associated with the socially liberal Democratic party?

Fail2ban regex pattern with angle brackets

Fail2ban on Ubuntu 11.10 does not ban custom filter/jailFail2Ban on CentOS 6.5 Never BansWriting a fail2ban multiline regexFail2Ban Not Banning on CentOS 7 with SELinuxfail2ban regex filter doesnt work with nginx log filesFail2ban regex doesn't match my log

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I'm starting with fail2ban and trying to match log lines of the Exim mail server. These log lines contain lots of <some@address.com> among the messages and I'd like to match them as restrictive as possible. Here's one of my regex lines:

[<HOST>] .* rejected RCPT <.*>: Unknown user$

However it doesn't seem to match that. I've watched the log and found a host with the same IP address that has caused several of such lines that I have regex patterns for. Yet it isn't banned.

Is there something special about the < and > characters in fail2ban's regex syntax? These aren't regex special characters but fail2ban has these placeholders that are written in these angle brackets. I couldn't find any information about the correct syntax that fail2ban expects here.

Is my regex correct or how should I rewrite it? Can fail2ban match these two characters at all?

Also, I couldn't find much information about the config file syntax. So here's what I've written:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true

[exim]
enabled = true
filter = exim
failregex = [<HOST>]: 535 Incorrect authentication data
 [<HOST>] .* rejected RCPT <.*>: Unknown user$
 [<HOST>] .* rejected after DATA: This message scored [0-9.]+ spam points.$
 [<HOST>] sender verify fail for <.*>: Unrouteable address$
 [<HOST>] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log

Is this correct? Will it match these 5 patterns alternatively in the Exim log? Will any of these count to the 10 minutes interval and will any 5 of them trigger a ban?

I'm using fail2ban 0.9.3 from Ubuntu 16.04.

linux regex fail2ban

share|improve this question

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

add a comment | 

0

I'm starting with fail2ban and trying to match log lines of the Exim mail server. These log lines contain lots of <some@address.com> among the messages and I'd like to match them as restrictive as possible. Here's one of my regex lines:

[<HOST>] .* rejected RCPT <.*>: Unknown user$

However it doesn't seem to match that. I've watched the log and found a host with the same IP address that has caused several of such lines that I have regex patterns for. Yet it isn't banned.

Is there something special about the < and > characters in fail2ban's regex syntax? These aren't regex special characters but fail2ban has these placeholders that are written in these angle brackets. I couldn't find any information about the correct syntax that fail2ban expects here.

Is my regex correct or how should I rewrite it? Can fail2ban match these two characters at all?

Also, I couldn't find much information about the config file syntax. So here's what I've written:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true

[exim]
enabled = true
filter = exim
failregex = [<HOST>]: 535 Incorrect authentication data
 [<HOST>] .* rejected RCPT <.*>: Unknown user$
 [<HOST>] .* rejected after DATA: This message scored [0-9.]+ spam points.$
 [<HOST>] sender verify fail for <.*>: Unrouteable address$
 [<HOST>] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log

Is this correct? Will it match these 5 patterns alternatively in the Exim log? Will any of these count to the 10 minutes interval and will any 5 of them trigger a ban?

I'm using fail2ban 0.9.3 from Ubuntu 16.04.

linux regex fail2ban

share|improve this question

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

add a comment | 

I'm starting with fail2ban and trying to match log lines of the Exim mail server. These log lines contain lots of <some@address.com> among the messages and I'd like to match them as restrictive as possible. Here's one of my regex lines:

[<HOST>] .* rejected RCPT <.*>: Unknown user$

However it doesn't seem to match that. I've watched the log and found a host with the same IP address that has caused several of such lines that I have regex patterns for. Yet it isn't banned.

Is there something special about the < and > characters in fail2ban's regex syntax? These aren't regex special characters but fail2ban has these placeholders that are written in these angle brackets. I couldn't find any information about the correct syntax that fail2ban expects here.

Is my regex correct or how should I rewrite it? Can fail2ban match these two characters at all?

Also, I couldn't find much information about the config file syntax. So here's what I've written:

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true

[exim]
enabled = true
filter = exim
failregex = [<HOST>]: 535 Incorrect authentication data
 [<HOST>] .* rejected RCPT <.*>: Unknown user$
 [<HOST>] .* rejected after DATA: This message scored [0-9.]+ spam points.$
 [<HOST>] sender verify fail for <.*>: Unrouteable address$
 [<HOST>] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log

Is this correct? Will it match these 5 patterns alternatively in the Exim log? Will any of these count to the 10 minutes interval and will any 5 of them trigger a ban?

I'm using fail2ban 0.9.3 from Ubuntu 16.04.

linux regex fail2ban

share|improve this question

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

[<HOST>] .* rejected RCPT <.*>: Unknown user$

[DEFAULT]
ignoreip = 127.0.0.1/8 ::1
bantime = 3600
findtime = 600
maxretry = 5

[sshd]
enabled = true

[exim]
enabled = true
filter = exim
failregex = [<HOST>]: 535 Incorrect authentication data
 [<HOST>] .* rejected RCPT <.*>: Unknown user$
 [<HOST>] .* rejected after DATA: This message scored [0-9.]+ spam points.$
 [<HOST>] sender verify fail for <.*>: Unrouteable address$
 [<HOST>] .* rejected RCPT <.*>: relay not permitted$
action = iptables-multiport[name=exim,port="25,465,587"]
logpath = /var/log/exim4/main-*.log

share|improve this question

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

share|improve this question

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

edited May 31 at 19:25

asktyagi

521110

edited May 31 at 19:25

asktyagi

521110

asked May 29 at 19:03

ygoeygoe

1066

asked May 29 at 19:03

ygoeygoe

1066