On a shared server, it is showing "User unknown" attempts for some 15 to 30 domains in thousands like 5000 to 10000 from various IP source, which seems be using resources unnecessarily.
Is there a way to configure assp to discard such attempts from any ips ( if possible for 24 hours), if it repeats "User unknown" attempts for 3 times per IP ( maybe per hour or per day) in assp Please adivse. On Wed, May 26, 2010 at 10:01 PM, Paul K. Dickson < pdick...@frederickcountymd.gov> wrote: > That's a really bad idea. ASSP already does that in a sense but is smart > about it. Don't reinvent the wheel ;) > > > > From: MadTh <madan.feedb...@gmail.com> > > Reply-To: For Users of ASSP <assp-user@lists.sourceforge.net> > > Date: Wed, 26 May 2010 21:48:54 +0200 > > To: <assp-user@lists.sourceforge.net> > > Subject: [Assp-user] ASSP fail2ban > > > > Hi, > > > > In http://www.fail2ban.org/wiki/index.php/ASSP, > > > > > > For following log: > > > > Example: Nov-14-09 00:14:50 54090-05322 201.244.255.72 < > > bad...@gtgwhhrthrth.com> [SMTP Error] 550 5.1.1 User unknown: > > your.u...@your-domain.com > > > > > > Assp fail regex is : > > failregex = .*? \d{5}-\d{5} <HOST> <.*?> \[SMTP Error\] (.*) > > > > > > > > > > > > > > Can you please advise fail regex for log pattern : > > > > May-12-10 13:16:41 82.249.21.94 user unknown te...@somedomain.com; > > > > > > > > where, fail2ban. will be able to get the IP from above log alert > message, > > and then block it in IPtables. > > > > > > > > > > Thanks > > > ------------------------------------------------------------------------------ > > > > _______________________________________________ > > Assp-user mailing list > > Assp-user@lists.sourceforge.net > > https://lists.sourceforge.net/lists/listinfo/assp-user > > > > ------------------------------------------------------------------------------ > > _______________________________________________ > Assp-user mailing list > Assp-user@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/assp-user > ------------------------------------------------------------------------------ _______________________________________________ Assp-user mailing list Assp-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/assp-user
