fail2ban: (strictly) ban hosts that are well over the ratelimit

[mirror/dsa-puppet.git] / modules / fail2ban / files / filter / dsa-exim-strict.conf

diff --git a/modules/fail2ban/files/filter/dsa-exim-strict.conf b/modules/fail2ban/files/filter/dsa-exim-strict.conf
index 33310ab..02eeb06 100644 (file)
--- a/modules/fail2ban/files/filter/dsa-exim-strict.conf
+++ b/modules/fail2ban/files/filter/dsa-exim-strict.conf
@@ -4,4 +4,5 @@
 before = exim-common.conf
 
 [Definition]
-failregex = ^%(pid)s SMTP protocol error in "(?i:AUTH LOGIN)" .* \[<HOST>\] AUTH command used when not advertised$
+failregex = (?i)^%(pid)s SMTP protocol error in "AUTH LOGIN" %(host_info)sAUTH command used when not advertised$
+            ^%(pid)s %(host_info)sWarning: Sender rate \d{3,}.\d / [^ ]+ \(limit: \d\d?\)