Home › Forums › BlockHosts

Regex for dovecot

Wed, 2010–Mar–17

Hi,

I find a lot of following messages in my dovecot.log, generated by dovecot:

Mar 17 05:27:56 pop3-login: Info: Aborted login (auth failed, 1 attempts): user=, method=PLAIN, rip=94.76.226.93, lip=xx.xx.xx.xx

I tried already a generous rule like

"dovecot-LoginFailRip": r'.* pop3-login: Info: Aborted login .* \[{HOST_IP}]',

in blockhosts.cfg, but I can not see, that the respective IP is really blocked, even when trying a fresh start of blockhosts using
blockhosts.py --verbose

Anything wrong with the rule ?

‹ Block IP of format nn.nn.nn.nn/nn with IPTABLES pam_unix(vsftpd:auth) regexp ›
Thu, 2010-04-15 08:41 — ac

see cfg file

The blockhosts.cfg file already contains the correct pattern for the log message:

    "dovecot-LoginFail":
        r'{LOG_PREFIX{pop3-login}} Aborted login \[{HOST_IP}]',

So, it should have worked even without requiring additional patterns - check if your cfg has the above pattern.