I am using fail2ban on my mail server. I discovered this morning that there were some 5000 failed login attempts (in the course of 1 hour) via SMTP that didn't get picked up by my sasl filter. Here is an example of an entry in /var/log/mail.log

Jan 25 04:39:56 ***** postfix/smtpd[23828]: warning: 114-32-231-17.HINET-IP.hinet.net[]: SASL LOGIN authentication failed: authentication failure

Here's my (unmodified) sasl filter definition for fail2ban:

# Fail2Ban configuration file
# Author: Yaroslav Halchenko
# $Revision: 728 $


# Option: failregex
# Notes.: regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values: TEXT
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
ignoreregex =

Can anyone recommend an improvement to the regex that would have also caught this record?


Define another failregex

(?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(:.*)$

I tested this regex with fail2ban-regex and is working.

  • +1 for pointing out fail2ban-regex tool, wasn't aware of that. However...the difference in your regex is the last part and I don't see the issue there. Did you test the original regex? Using a quick test in python, re.match("(: [A-Za-z0-9+/]*={0,2})?", ": authentication failure") returns a Match object. – AJ. Jan 25 '12 at 12:52
  • Yes I tested the original regex and I tried to give you the simplest solution :). They forgot to include "space" in [A-Za-z0-9+/]. it should be "(?i): warning: [-._\w]+[<HOST>]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/\ ]*)?$" – Sacx Jan 25 '12 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.