From e46e8ed32e2adc68dda08695ea65202fb9b296f3 Mon Sep 17 00:00:00 2001
From: Cyril Jaquier <cyril.jaquier@fail2ban.org>
Date: Tue, 27 Jan 2009 23:35:46 +0000
Subject: [PATCH] - Improved SASL filter. Thanks to Loic Pefferkorn. Tracker
 #2310410.

git-svn-id: https://fail2ban.svn.sourceforge.net/svnroot/fail2ban/branches/FAIL2BAN-0_8@723 a942ae1a-1317-0410-a47c-b1dcaea8d605
---
 ChangeLog                 | 4 +++-
 config/filter.d/sasl.conf | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index fe73c096..6150aea7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -26,7 +26,9 @@ ver. 0.8.4 (2008/??/??) - stable
   Debian bug #500824.
 - Added nagios script. Thanks to Sebastian Mueller.
 - Added CPanel date format. Thanks to David Collins. Tracker
-  #1967610
+  #1967610.
+- Improved SASL filter. Thanks to Loic Pefferkorn. Tracker
+  #2310410.
 
 ver. 0.8.3 (2008/07/17) - stable
 ----------
diff --git a/config/filter.d/sasl.conf b/config/filter.d/sasl.conf
index c25aca6b..bff6f92b 100644
--- a/config/filter.d/sasl.conf
+++ b/config/filter.d/sasl.conf
@@ -14,7 +14,7 @@
 #          (?:::f{4,6}:)?(?P<host>\S+)
 # Values: TEXT
 #
-failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed$
+failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/]*={0,2})?$
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.