Fail2Ban failregex for Kopano Gateway



  • I bit my teeth until it worked and got a bit help from others…

    this regegex works for IPv4:

    failregex = (?i): Failed to login from [<HOST>:\d+].*
    

    with fail log: kopano-gateway[2799]: Failed to login from [xxx.xxx.xxx.xx:23633] with invalid username "user@domain" or wrong password: logon failed

    Note the above regex will not work for log like this in IPv6:

    gateway[9312]: Failed to login from [[::ffff:xxx.xxx.xxx.xx]:57306] with invalid username "user@domain" or wrong password: logon failed

    i change in gateway.cfg
    from:

    imap_listen = *:143
    imaps_listen = *:993
    

    to the internal ip adress:

    imap_listen = xxx.xxx.xxx.xx:143
    imaps_listen = xxx.xxx.xxx.xx:993
    

    i don’t use IPv6 but if i find a solution i will post here.
    cheers



  • try this :

    failregex = (?i): Failed to login from [<HOST>:\d+].*
                (?i): Failed to login from \[[<HOST>:\d+]\].*
    
    


  • Hi @thctlo

    i try but not work if i change kopano-gateway to:

    imap_listen = *:143
    imaps_listen = *:993
    

    Fail2Ban does not want to recognize it.


Log in to reply