CERBERUS/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-08-04 14:48:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixes #4196: adjusted REs considering password mismatch from sql backend/driver of dovecot 2.4
Some checks failed
Codespell / Check for spelling errors (push) Has been cancelled
Details
CI / build (3.10) (push) Has been cancelled
Details
CI / build (3.11) (push) Has been cancelled
Details
CI / build (3.12) (push) Has been cancelled
Details
CI / build (3.13) (push) Has been cancelled
Details
CI / build (3.14) (push) Has been cancelled
Details
CI / build (3.15.0-alpha.5) (push) Has been cancelled
Details
CI / build (3.8) (push) Has been cancelled
Details
CI / build (3.9) (push) Has been cancelled
Details
CI / build (pypy3.11) (push) Has been cancelled
Details

Browse source
This commit is contained in:
sebres 2026-06-24 01:29:06 +02:00
parent 2c1eb69381
commit 1ebc369b05
2 changed files with 16 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
config/filter.d/dovecot.conf
View file

@ -7,21 +7,25 @@ before = common.conf
[Definition]
__hostname = \w+(?:[\-\.]\w+)*
_daemon = (?:dovecot(?:-auth)?|auth)
# auth backend or driver, e. g. pam, sql, passwd-file, etc:
_auth_driver = [a-z\-]+
_auth_worker = (?:dovecot: )?auth(?:-worker)?
_auth_worker_info = (?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
_auth_worker_info = (?:%(_auth_driver)s: )?(?:conn \w+:auth(?:-worker)? \([^\)]+\): auth(?:-worker)?<\d+>: )?
_bypass_reject_reason = (?:: (?:\w+\([^\):]*\) \w+|[^\(]+))*
prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\([^\)]+\))?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
prefregex = ^%(__prefix_line)s(?:%(_auth_worker)s(?:\((?:\S*,<ADDR>(?:,\S*)?|[^\)]+)\))?(?:<[^>]+>)?: )?(?:%(__pam_auth)s(?:\(dovecot:auth\))?: |(?:pop3|imap|managesieve|submission)-login: )?(?:request \[\d+\]: )?(?:Info: )?%(_auth_worker_info)s<F-CONTENT>.+</F-CONTENT>$
failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<HOST>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
^(?:Login aborted|Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\)[^:]*:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
^pam\(\S+,<HOST>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
^[a-z\-]{3,15}\(\S*,<HOST>(?:,\S*)?\): (?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
failregex = ^authentication failure; logname=<F-ALT_USER1>\S*</F-ALT_USER1> uid=\S* euid=\S* tty=dovecot ruser=<F-USER>\S*</F-USER> rhost=<ADDR>(?:\s+user=<F-ALT_USER>\S*</F-ALT_USER>)?\s*$
^(?:Login aborted|Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:auth failed, \d+ attempts(?: in \d+ secs)?|tried to use (?:disabled|disallowed) \S+ auth|proxy dest auth failed)\)[^:]*:(?: user=<<F-USER>[^>]*</F-USER>>,)?(?: method=\S+,)? rip=<ADDR>(?:[^>]*(?:, session=<\S+>)?)\s*$
^pam\(\S+,<ADDR>(?:,\S*)?\): pam_authenticate\(\) failed: (?:User not known to the underlying authentication module: \d+ Time\(s\)|Authentication failure \([Pp]assword mismatch\?\)|Permission denied)\s*$
^(?:[a-z\-]{3,15}\(\S*,<ADDR>(?:,\S*)?\): )?(?:[Uu]nknown user|[Ii]nvalid credentials|[Pp]assword mismatch)
<mdre-<mode>>
mdre-aggressive = ^(?:Login aborted|Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,|disconnected during TLS handshake)(?: (?:in|waited) \d+ secs)?\)[^:]*:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<HOST>(?:[^>]*(?:, session=<\S+>)?)\s*$
mdre-aggressive = ^(?:Login aborted|Aborted login|Disconnected|Remote closed connection|Client has quit the connection)%(_bypass_reject_reason)s \((?:no auth attempts|disconnected before auth was ready,|client didn't finish \S+ auth,|disconnected during TLS handshake)(?: (?:in|waited) \d+ secs)?\)[^:]*:(?: user=<[^>]*>,)?(?: method=\S+,)? rip=<ADDR>(?:[^>]*(?:, session=<\S+>)?)\s*$
mdre-normal =

5
fail2ban/tests/files/logs/dovecot
View file

@ -139,6 +139,11 @@ Aug 29 03:53:52 server dovecot: submission-login: Remote closed connection (auth
# failJSON: { "time": "2004-08-29T15:33:53", "match": true , "host": "192.0.2.100" }
Aug 29 15:33:53 server dovecot: managesieve-login: Disconnected: Too many invalid commands. (auth failed, 1 attempts in 2 secs): user=<myself>, method=PLAIN, rip=192.0.2.100, lip=0.0.0.0, TLS, TLSv1.3 with cipher TLS_CHACHA20_POLY1305_SHA256 (256/256 bits)
# failJSON: { "time": "2004-08-30T00:10:57", "match": true , "host": "192.0.2.110", "desc": "password mismatch from sql backend/driver of dovecot 2.4, gh-4196" }
Aug 30 00:10:57 auth(info@example.com,192.0.2.110,sasl:login)<CvN+E95Uf4e7eEnj>: Info: sql: Password mismatch (given password: XxxxXXxx123)
# failJSON: { "time": "2004-08-30T00:11:05", "match": true , "host": "192.0.2.110", "desc": "closed after 3 attempts (password mismatch), gh-4196" }
Aug 30 00:11:05 imap-login: Info: Login aborted: Connection closed (auth failed, 3 attempts in 16 secs) (auth_failed): user=<info@example.com>, method=PLAIN, rip=192.0.2.110, lip=0.0.0.0, TLS, session=<CvN+E95Uf4e7eEnj>
# ---------------------------------------
# Test-cases of aggressive mode:
# ---------------------------------------