Am trying to write a fail2ban regex that catches anyone who tries the user-id "administrador". For example, this log entry:
Jan 2 09:55:01 mail2 dovecot: pop3-login: Disconnected: user=<administrador>, method=PLAIN, rip=::ffff:220.127.116.11
Here's the regex I have so far:
failregex = (?: pop3-login|imap-login): .*(?:Disconnected: user=\<administrador\>).*rip=(?P<host>\S*),.*
It doesn't catch the log entry above because the syntax is wrong. Can anyone help?