Re: [Dovecot] Fail2ban and logging

2013-07-17 Thread Paul van der Vlis
Hello Mark (and others), On 16-07-13 05:00, Mark Sapiro wrote: > On 07/15/2013 09:09 AM, Paul van der Vlis wrote: >> >> Are you blocked when you login a few times with a wrong password? >> >> I expect your log will say something like "auth failed, 22 attempts in >> 30 secs", and fail2ban will see

Re: [Dovecot] Fail2ban and logging

2013-07-15 Thread Mark Sapiro
On 07/15/2013 09:09 AM, Paul van der Vlis wrote: > > Are you blocked when you login a few times with a wrong password? > > I expect your log will say something like "auth failed, 22 attempts in > 30 secs", and fail2ban will see that as 1 authentications error, so will > not block you. I am bloc

Re: [Dovecot] Fail2ban and logging

2013-07-15 Thread Paul van der Vlis
On 14-07-13 20:52, Mark Sapiro wrote: > On 07/14/2013 03:26 AM, Paul van der Vlis wrote: >> Hello, >> >> Dovecot is logging authentication failures this way: >> -- >> Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 >> attempts in 172 secs): user=, method=PLAIN, rip=82.95

Re: [Dovecot] Fail2ban and logging

2013-07-14 Thread Mark Sapiro
On 07/14/2013 03:26 AM, Paul van der Vlis wrote: > Hello, > > Dovecot is logging authentication failures this way: > -- > Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 > attempts in 172 secs): user=, method=PLAIN, rip=82.95.148.152, > lip=1.2.3.4, TLS, session= >

[Dovecot] Fail2ban and logging

2013-07-14 Thread Paul van der Vlis
Hello, Dovecot is logging authentication failures this way: -- Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 attempts in 172 secs): user=, method=PLAIN, rip=82.95.148.152, lip=1.2.3.4, TLS, session= -- Fail2ban is trying to catch them with this regex: -- fail