Fail2Ban failregex for Kopano Gateway

noise

I bit my teeth until it worked and got a bit help from others…

this regegex works for IPv4:

failregex = (?i): Failed to login from [<HOST>:\d+].*

with fail log: kopano-gateway[2799]: Failed to login from [xxx.xxx.xxx.xx:23633] with invalid username "user@domain" or wrong password: logon failed

Note the above regex will not work for log like this in IPv6:

gateway[9312]: Failed to login from [[::ffff:xxx.xxx.xxx.xx]:57306] with invalid username "user@domain" or wrong password: logon failed

i change in gateway.cfg
from:

imap_listen = *:143
imaps_listen = *:993

to the internal ip adress:

imap_listen = xxx.xxx.xxx.xx:143
imaps_listen = xxx.xxx.xxx.xx:993

i don’t use IPv6 but if i find a solution i will post here.
cheers

thctlo

try this :

failregex = (?i): Failed to login from [<HOST>:\d+].*
            (?i): Failed to login from [[<HOST>:\d+]\].*

noise

Hi @thctlo

i try but not work if i change kopano-gateway to:

imap_listen = *:143
imaps_listen = *:993

Fail2Ban does not want to recognize it.