Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here is an example of an entry in /var/log/mail.log

Jan 25 04:39:56 ***** postfix/smtpd[23828]: warning: 114-32-231-17.HINET-IP.hinet.net[114.32.231.17]: SASL LOGIN authentication failed: authentication failure

Here's my (unmodified) sasl filter definition for fail2ban:

# Fail2Ban configuration file
#
# Author: Yaroslav Halchenko
#
# $Revision: 728 $
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
#
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

Can anyone recommend an improvement to the regex that would have also caught this record?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Define another failregex

(?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:.*)$

I tested this regex with fail2ban-regex and is working.

share|improve this answer
    
+1 for pointing out fail2ban-regex tool, wasn't aware of that. However...the difference in your regex is the last part and I don't see the issue there. Did you test the original regex? Using a quick test in python, re.match("(: [A-Za-z0-9+/]*={0,2})?", ": authentication failure") returns a Match object. –  AJ. Jan 25 '12 at 12:52
    
Yes I tested the original regex and I tried to give you the simplest solution :). They forgot to include "space" in [A-Za-z0-9+/]. it should be "(?i): warning: [-._\w]+[<HOST>]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/\ ]*)?$" –  Sacx Jan 25 '12 at 13:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.