On a shared server, it is showing "User unknown" attempts for some 15 to 30 domains in thousands like 5000 to 10000 from various IP source, which seems be using resources unnecessarily.
Is there a way to configure assp to discard such attempts from any ips ( if possible for 24 hours), if it repeats "User unknown" attempts for 3 times per IP ( maybe per hour or per day) in assp Please adivse. On Wed, May 26, 2010 at 10:01 PM, Paul K. Dickson < [email protected]> wrote: > That's a really bad idea. ASSP already does that in a sense but is smart > about it. Don't reinvent the wheel ;) > > > > From: MadTh <[email protected]> > > Reply-To: For Users of ASSP <[email protected]> > > Date: Wed, 26 May 2010 21:48:54 +0200 > > To: <[email protected]> > > Subject: [Assp-user] ASSP fail2ban > > > > Hi, > > > > In http://www.fail2ban.org/wiki/index.php/ASSP, > > > > > > For following log: > > > > Example: Nov-14-09 00:14:50 54090-05322 201.244.255.72 < > > [email protected]> [SMTP Error] 550 5.1.1 User unknown: > > [email protected] > > > > > > Assp fail regex is : > > failregex = .*? \d{5}-\d{5} <HOST> <.*?> \[SMTP Error\] (.*) > > > > > > > > > > > > > > Can you please advise fail regex for log pattern : > > > > May-12-10 13:16:41 82.249.21.94 user unknown [email protected]; > > > > > > > > where, fail2ban. will be able to get the IP from above log alert > message, > > and then block it in IPtables. > > > > > > > > > > Thanks > > > ------------------------------------------------------------------------------ > > > > _______________________________________________ > > Assp-user mailing list > > [email protected] > > https://lists.sourceforge.net/lists/listinfo/assp-user > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Assp-user mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/assp-user > ------------------------------------------------------------------------------ _______________________________________________ Assp-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/assp-user
