Re: [Dovecot] Fail2ban and logging

2013-07-17 Thread Paul van der Vlis
Hello Mark (and others), On 16-07-13 05:00, Mark Sapiro wrote: On 07/15/2013 09:09 AM, Paul van der Vlis wrote: Are you blocked when you login a few times with a wrong password? I expect your log will say something like auth failed, 22 attempts in 30 secs, and fail2ban will see that as 1

Re: [Dovecot] Fail2ban and logging

2013-07-15 Thread Paul van der Vlis
On 14-07-13 20:52, Mark Sapiro wrote: On 07/14/2013 03:26 AM, Paul van der Vlis wrote: Hello, Dovecot is logging authentication failures this way: -- Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 attempts in 172 secs): user=info, method=PLAIN,

Re: [Dovecot] Fail2ban and logging

2013-07-15 Thread Mark Sapiro
On 07/15/2013 09:09 AM, Paul van der Vlis wrote: Are you blocked when you login a few times with a wrong password? I expect your log will say something like auth failed, 22 attempts in 30 secs, and fail2ban will see that as 1 authentications error, so will not block you. I am blocked.

[Dovecot] Fail2ban and logging

2013-07-14 Thread Paul van der Vlis
Hello, Dovecot is logging authentication failures this way: -- Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 attempts in 172 secs): user=info, method=PLAIN, rip=82.95.148.152, lip=1.2.3.4, TLS, session=QylMqlLhVwBSX5SY -- Fail2ban is trying to catch them with

Re: [Dovecot] Fail2ban and logging

2013-07-14 Thread Mark Sapiro
On 07/14/2013 03:26 AM, Paul van der Vlis wrote: Hello, Dovecot is logging authentication failures this way: -- Jul 12 18:07:19 vps0 dovecot: imap-login: Disconnected (auth failed, 22 attempts in 172 secs): user=info, method=PLAIN, rip=82.95.148.152, lip=1.2.3.4, TLS,