From Fail2ban
Revision as of 11:54, 20 March 2010 by (Talk) (Sendmail Regex)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Don't remember where I got the information for this Regex but here is the contents of my sendmail.conf file that has successful banned many IPs from spamming my email server

  1. Fail2Ban configuration file
  2. Author:
  3. $Revision: 0 $


  1. Option: failregex
  2. Notes.: regex to match the password failures messages in the logfile. The
  3. host must be matched by a group named "host". The tag "<HOST>" can
  4. be used for standard IP/hostname matching and is only an alias for
  5. (?:::f{4,6}:)?(?P<host>\S+)
  6. Values: TEXT

failregex = \[<HOST>\] .*to MTA

           \[<HOST>\] \(may be forged\)
           \[<HOST>\], reject.*\.\.\. Relaying denied
           (User unknown)\n* \[<HOST>\]
  1. Option: ignoreregex
  2. Notes.: regex to ignore. If this regex matches, the line is ignored.
  3. Values: TEXT

ignoreregex =