FM / filter.d

/etc/fail2ban/filter.d

Name	Size	Mode	Actions
ignorecommands/	-	0755	rm
3proxy.conf	467	0644	edit dl rm
apache-auth.conf	3228	0644	edit dl rm
apache-badbots.conf	2831	0644	edit dl rm
apache-botsearch.conf	1265	0644	edit dl rm
apache-common.conf	1619	0644	edit dl rm
apache-fakegooglebot.conf	324	0644	edit dl rm
apache-modsecurity.conf	511	0644	edit dl rm
apache-nohome.conf	596	0644	edit dl rm
apache-noscript.conf	1246	0644	edit dl rm
apache-overflows.conf	2184	0644	edit dl rm
apache-pass.conf	362	0644	edit dl rm
apache-shellshock.conf	1020	0644	edit dl rm
assp.conf	3492	0644	edit dl rm
asterisk.conf	2369	0644	edit dl rm
bitwarden.conf	427	0644	edit dl rm
botsearch-common.conf	522	0644	edit dl rm
centreon.conf	307	0644	edit dl rm
common.conf	2775	0644	edit dl rm
counter-strike.conf	244	0644	edit dl rm
courier-auth.conf	463	0644	edit dl rm
courier-smtp.conf	512	0644	edit dl rm
cyrus-imap.conf	444	0644	edit dl rm
directadmin.conf	338	0644	edit dl rm
domino-smtp.conf	2107	0644	edit dl rm
dovecot.conf	2453	0644	edit dl rm
dropbear.conf	1730	0644	edit dl rm
drupal-auth.conf	557	0644	edit dl rm
ejabberd-auth.conf	1572	0644	edit dl rm
exim-common.conf	516	0644	edit dl rm
exim-spam.conf	2158	0644	edit dl rm
exim.conf	2875	0644	edit dl rm
freeswitch.conf	1922	0644	edit dl rm
froxlor-auth.conf	1210	0644	edit dl rm
gitlab.conf	236	0644	edit dl rm
grafana.conf	388	0644	edit dl rm
groupoffice.conf	236	0644	edit dl rm
gssftpd.conf	322	0644	edit dl rm
guacamole.conf	1447	0644	edit dl rm
haproxy-http-auth.conf	1170	0644	edit dl rm
horde.conf	404	0644	edit dl rm
kerio.conf	938	0644	edit dl rm
lighttpd-auth.conf	333	0644	edit dl rm
mongodb-auth.conf	2279	0644	edit dl rm
monit.conf	787	0644	edit dl rm
murmur.conf	927	0644	edit dl rm
mysqld-auth.conf	953	0644	edit dl rm
nagios.conf	400	0644	edit dl rm
named-refused.conf	1496	0644	edit dl rm
nginx-botsearch.conf	681	0644	edit dl rm
nginx-http-auth.conf	485	0644	edit dl rm
nginx-limit-req.conf	1454	0644	edit dl rm
nsd.conf	760	0644	edit dl rm
openhab.conf	452	0644	edit dl rm
openwebmail.conf	495	0644	edit dl rm
oracleims.conf	1937	0644	edit dl rm
pam-generic.conf	947	0644	edit dl rm
perdition.conf	568	0644	edit dl rm
php-url-fopen.conf	891	0644	edit dl rm
phpmyadmin-syslog.conf	278	0644	edit dl rm
portsentry.conf	242	0644	edit dl rm
postfix.conf	3164	0644	edit dl rm
proftpd.conf	1163	0644	edit dl rm
pure-ftpd.conf	2409	0644	edit dl rm
qmail.conf	795	0644	edit dl rm
recidive.conf	1374	0644	edit dl rm
roundcube-auth.conf	1541	0644	edit dl rm
scanlogd.conf	354	0644	edit dl rm
screensharingd.conf	821	0644	edit dl rm
selinux-common.conf	538	0644	edit dl rm
selinux-ssh.conf	570	0644	edit dl rm
sendmail-auth.conf	776	0644	edit dl rm
sendmail-reject.conf	2949	0644	edit dl rm
sieve.conf	371	0644	edit dl rm
slapd.conf	706	0644	edit dl rm
softethervpn.conf	451	0644	edit dl rm
sogo-auth.conf	722	0644	edit dl rm
solid-pop3d.conf	1094	0644	edit dl rm
squid.conf	260	0644	edit dl rm
squirrelmail.conf	191	0644	edit dl rm
sshd.conf	7518	0644	edit dl rm
stunnel.conf	363	0644	edit dl rm
suhosin.conf	649	0644	edit dl rm
tine20.conf	890	0644	edit dl rm
traefik-auth.conf	2390	0644	edit dl rm
uwimap-auth.conf	374	0644	edit dl rm
vsftpd.conf	637	0644	edit dl rm
webmin-auth.conf	444	0644	edit dl rm
wordpress.conf	93	0644	edit dl rm
wuftpd.conf	520	0644	edit dl rm
xinetd-fail.conf	521	0644	edit dl rm
znc-adminlog.conf	912	0644	edit dl rm
zoneminder.conf	524	0644	edit dl rm

Edit: /etc/fail2ban/filter.d/assp.conf (3492B)

# Fail2Ban filter for Anti-Spam SMTP Proxy Server (ASSP)
#    Filter works in theory for both ASSP V1 and V2. Recommended ASSP is V2.5.1 or later.
#    Support for ASSP V1 ended in 2014 so if you are still running ASSP V1 an immediate upgrade is recommended.
#
#    Homepage:    http://sourceforge.net/projects/assp/
#    ProjectSite: http://sourceforge.net/projects/assp/?source=directory
#
#

[Definition] 
# Note: First three failregex matches below are for ASSP V1 with the remaining being designed for V2. Deleting the V1 regex is recommended but I left it in for compatibility reasons.

__assp_actions = (?:dropping|refusing)

failregex = ^(:? \[SSL-out\])? <HOST> max sender authentication errors $\d{,3}$ exceeded -- %(__assp_actions)s connection - after reply: \d{3} \d{1}\.\d{1}.\d{1} Error: authentication failed: \w+;$
			^(?: \[SSL-out\])? <HOST> SSL negotiation with client failed: SSL accept attempt failed with unknown error.*:unknown protocol;$
			^ Blocking <HOST> - too much AUTH errors $\d{,3}$;$
			^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> (?:\<\S+@\S+\.\S+\> )*(?:to: \S+@\S+\.\S+ )*relay attempt blocked for(?: $parsing$)?: \S+$
			^\s*(?:[\w\-]+\s+)*(?:\[\S+\]\s+)*<HOST> \[SMTP Error\] 535 5\.7\.8 Error: authentication failed:\s+(?:\S+|Connection lost to authentication server|Invalid authentication mechanism|Invalid base64 data in continued response)?$

ignoreregex =

datepattern = {^LN-BEG}%%b-%%d-%%Exy %%H:%%M:%%S
              {^LN-BEG}

# DEV Notes:
# V1 Examples matches:
#   Apr-27-13 02:33:09 Blocking 217.194.197.97 - too much AUTH errors (41);
#   Dec-29-12 17:10:31 [SSL-out] 200.247.87.82 SSL negotiation with client failed: SSL accept attempt failed with unknown errorerror:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol;
#   Dec-30-12 04:01:47 [SSL-out] 81.82.232.66 max sender authentication errors (5) exceeded 
#
# V2 Examples matches:
#   Jul-29-16 16:49:52 m1-25391-06124 [Worker_1] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user@example.org relay attempt blocked for: someone@example.org
#   Jul-30-16 16:59:42 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
#   Jul-30-16 00:15:36 m1-52131-09651 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: UGFzc3dvcmQ6
#   Jul-31-16 06:45:59 [Worker_1] [TLS-in] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed:
#   Jan-05-16 08:38:49 m1-01129-09140 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> relay attempt blocked for (parsing): <user2@example>
#   Jun-12-16 16:43:37 m1-64217-12013 [Worker_1] [TLS-in] [TLS-out] [RelayAttempt] 0.0.0.0 <user@example.com> to: user2@example.com relay attempt blocked for (parsing): <a.notheruser69@example.c>
#   Jan-22-16 22:25:51 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid authentication mechanism
#   Mar-19-16 13:42:20 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Invalid base64 data in continued response
#   Jul-18-16 16:54:21 [Worker_2] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server
#   Jul-18-16 17:14:23 m1-76453-02949 [Worker_1] [TLS-out] 0.0.0.0 [SMTP Error] 535 5.7.8 Error: authentication failed: Connection lost to authentication server

#
# Author: Enrico Labedzki (enrico.labedzki@deiwos.de)
# V2 Filters: Robert Hardy (rhardy@webcon.ca)

cmd: