# Fail2Ban configuration file for DAViCal
#
# Author: Fabian Wenk <fabian@wenks.ch>
#
# $Revision$
#
# DAViCal does its logging into the Apache error.log of the corresponding
# virtualhost.

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT
#
failregex = \[client <HOST>(:\d+)?\] davical: Login failure: WARN: Invalid username or password., referer: .*$
            \[client <HOST>(:\d+)?\] davical: \*\*\*: ERROR:authentication failure for user \'.*\' from host \[.*\]$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex = 

# Fail2Ban configuration file for roundcube webmail
#
# Author: Fabian Wenk <fabian@wenks.ch>
#
# $Revision$
#
# To have logging information available, it is necessary to adjusting
# the following option in config/main.inc.php from Roundcube:
#
# $rcmail_config['debug_level'] = 1;	// not sure, probably not needed
# $rcmail_config['log_session'] = true;
#
# and point in the fail2ban jail config to the correct logfile,
# or change also the following config to log to syslog:
#
# $rcmail_config['log_driver'] = 'syslog';
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
#	first line is for Cyrus IMAP (2.4.x)
#	second line is for Dovecot (2.1.x)
# Values: TEXT
#
failregex = roundcube: IMAP Error: Login failed for .* from <HOST>. AUTHENTICATE PLAIN: authentication failure in .*$
	    roundcube: IMAP Error: Login failed for .* from <HOST>. AUTHENTICATE PLAIN: Authentication failed. in .*$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =  

# Fail2Ban configuration file for sendmail-auth
#
# Author: Fabian Wenk <fabian@wenks.ch>
#
# $Revision$
#

[Definition]

# Option: failregex
# Notes.: regex to match the password failures messages in the logfile.
# Values: TEXT
#
failregex = (sm-mta|sendmail)(?:\[\d+\])?: .*: (.*)\[<HOST>\]( \(may be forged\)|): possible SMTP attack: command=AUTH, count=\d+$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =  

# Fail2Ban configuration file for sendmail
#
# Author: Fabian Wenk <fabian@wenks.ch>
#
# $Revision$
#
# Some of the below failregex will only work properly, when the following
# options are set in the .mc file (see your Sendmail documentation on how
# to modify it and generate the corresponding .cf file):
#
# FEATURE(`delay_checks')
# FEATURE(`greet_pause', `500')
# FEATURE(`ratecontrol', `nodelay', `terminate')
# FEATURE(`conncontrol', `nodelay', `terminate')
#
# ratecontrol and conncontrol also need corresponding options ClientRate:
# and ClientConn: in the access file, see documentation for ratecontrol and
# conncontrol in the sendmail/cf/README file.
#

[Definition]

# Option: failregex
# Notes.: regex to match rejected connections in the logfile.
# Values: TEXT
#
failregex = (sm-mta|sendmail)(?:\[\d+\])?: ruleset=check_relay, arg1=.*, arg2=<HOST>, relay=.*, reject=421 4.3.2 Too many open connections.$
	    (sm-mta|sendmail)(?:\[\d+\])?: ruleset=check_relay, arg1=.*, arg2=<HOST>, relay=.*, reject=421 4.3.2 Connection rate limit exceeded.$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: rejecting commands from .* \[<HOST>\] due to pre-greeting traffic after \d+ seconds$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: ruleset=check_rcpt, arg1=\<.*\>, relay=\[.*\], reject=550 5.7.1 \<.*\>... Relaying denied. IP name lookup failed \[<HOST>\]$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: ruleset=check_rcpt, arg1=\<.*\>, relay=.* \[.*\] \(may be forged\), reject=550 5.7.1 \<.*\>... Relaying denied. IP name possibly forged \[<HOST>\]$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: ruleset=check_rcpt, arg1=\<.*\>, relay=.* \[<HOST>\], reject=550 5.7.1 \<.*\>... Relaying denied. Proper authentication required.$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: ruleset=check_rcpt, arg1=\<.*\>, relay=.*\[<HOST>\].*, reject=550 5.1.1 \<.*\>... User unknown$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: ruleset=check_rcpt, arg1=\<.*\>, relay=.*\[<HOST>\].*, reject=553 5.1.8 \<.*\>... Domain of sender address .* does not exist$
	    (sm-mta|sendmail)(?:\[\d+\])?: .*: (.*)\[<HOST>\]: (?i)(EXPN|VRFY) .* \[rejected\]$

# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =