Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry:

Jan  2 09:55:01 mail2 dovecot: pop3-login: Disconnected: user=<administrador>, method=PLAIN, rip=::ffff:

Here's the regex I have so far:

failregex = (?: pop3-login|imap-login): .*(?:Disconnected: user=\<administrador\>).*rip=(?P<host>\S*),.*

It doesn't catch the log entry above because the syntax is wrong. Can anyone help?

share|improve this question
The way I usually use to write regex is to start with a very simple one and then improve it gradually to get a perfect one. Otherwise, you will find it too difficult to debug the problem. –  Khaled Jan 4 '12 at 20:27

2 Answers 2

Your pattern starts with "pop3" or "imap"... The log entry starts with a date.

failregex = .*(pop3-login|imap-login).*administrator.*rip=<HOST>

Should work (though I haven't tested it)

Also found this Fail2Ban entry on the DovecotWiki.

share|improve this answer
Thanks, but I tested that regex and it doesn't catch the desired entry. The date part of the log seems to be processed separately from the regex in fail2ban, so we don't need to include the .* at the beginning. Am guessing the syntax problem might start around the remote ip (rip) area ... –  ane Jan 4 '12 at 19:39
up vote 1 down vote accepted

Experimented further and was able to create a working one. The problem was around the remote ip (rip) section. Here's what worked:

failregex = (?: pop3-login|imap-login): .*(?:Disconnected: user=\<administrador\>).*rip=.*ffff\:(<HOST>).*

It might not be very efficient though. Any suggestions to improve it are still welcome.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.