# Fail2Ban filter for authentication failures on Cyrus imap server
#
#
#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

_daemon = (?:cyrus/)?(?:imap(d|s)?|pop3(d|s)?)

failregex = ^%(__prefix_line)sbadlogin: [^\[]*\[<HOST>\] \S+ .*?\[?SASL\(-13\): (authentication failure|user not found): .*\]?$

ignoreregex = 

# Author: Jan Wagner <[email protected]>