Thanks for the replies today -- I'll reply to all of them in one email to save list traffic... please see below for specific responses. Unfortunately still no luck. Thanks!
--- Amir On Mar 27, 2019, at 1:26 AM, Dominic Raferd <[email protected]> wrote:
Yes, I am aware and I have considered it, but it is not an option at the moment, for various reasons. On Mar 27, 2019, at 3:37 AM, Bob Brewer <[email protected]> wrote:
Thanks for the suggestion but unfortunately that's not it -- all the other filter files have the same permissions and work fine. This filter file was made by copying sendmail-auth.conf and modifying the failregex appropriately. As mentioned, the file works absolutely fine using fail2ban-regex, meaning the regex itself is correct... and manually banning also works fine, meaning the jail itself is also set up OK. So for whatever reason, something is wrong with fail2ban-server working with it autonomously, even though the regex is correct and works, and the jail is also OK. On Mar 27, 2019, at 3:56 AM, Bob Brewer <[email protected]> wrote:
This is a custom filter, not one that is distributed with fail2ban. The filter name and the jail name are both correct, that was the first thing I tested. I tried changing the name to something else (making sure jail and filter matched), still no luck. On Mar 27, 2019, at 7:03 AM, Iosif Fettich <[email protected]> wrote:
Unfortunately no help. Also, the exact same prefix line works fine on all my other sendmail filters, and it works fine with fail2ban-regex as well, so that doesn't appear to be it. I really don't understand why fail2ban-regex finds hundreds of matches, but fail2ban-server doesn't. On Mar 27, 2019, at 8:24 AM, Nick Howitt <[email protected]> wrote: Shouldn't: No, the exact failure line from sendmail has all four separated by slashes ... I provided an example in my original email: Mar 26 02:40:53 servername sm-mta[10953]: x2Q2eiHC010953: mta9.imxonlines.co.za [91.212.150.89] (may be forged) did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA Sendmail is complaining that the offender did not issue any of those 4 commands prior to disconnect. (Those commands require authorization to use, hence why they can't be issued when someone fails auth.) Thanks! |
_______________________________________________ Fail2ban-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/fail2ban-users
