[Dovecot] Audit log?

[Bjørn T Johansen]

If you know regexp so... But thx... :)

BTJ

On Fri, 21 Dec 2007 15:40:09 +0000
Rob Coward <rob.coward at game.co.uk> wrote:

> Yes, but surely its not a big leap for you to rewrite my regex to:
> 
> auth\(default\): sql\(.*,<HOST>\): Password mismatch
> 
> Rob
> 
> On Fri, 2007-12-21 at 16:30 +0100, Bjørn T Johansen wrote:
> > Yes, but that doesn't work for sql auth; as you see, the line logged is different...
> > 
> > BTJ
> > 
> > On Fri, 21 Dec 2007 14:32:01 +0000
> > Rob Coward <rob.coward at game.co.uk> wrote:
> > 
> > > I use pam authentication in dovecot and the following fail2ban filter
> > > seems to work fine for me:
> > > 
> > > failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\)
> > > failed:
> > > 
> > > Rob
> > > 
> > > On Fri, 2007-12-21 at 12:04 +0100, Bj__rn T Johansen wrote:
> > > 
> > > > On Thu, 20 Dec 2007 18:42:01 +0200
> > > > Timo Sirainen <tss at iki.fi> wrote:
> > > > 
> > > > > On Thu, 2007-12-20 at 13:18 +0100, Bj__rn T Johansen wrote:
> > > > > > Yes, I know about those but I was kind of hoping to see failed authentications in some logs without
> > > > > > enabling debug logging, like if I use PAM authentication....
> > > > > 
> > > > > auth_verbose=yes enables logging failed logins.
> > > > > 
> > > > 
> > > > That did the trick... thx... :)
> > > > 
> > > > If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of
> > > > cake but...
> > > > 
> > > > Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A)
> > > > (or perhaps someone could create a regexp that recognize a line like this:
> > > > 
> > > > dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj at havleik.no,85.19.143.23): Password mismatch
> > > > 
> > > > )
> > > > 
> > > > 
> > > > BTJ
> > > 
> > > 
> > > Please consider the environment before printing this email. 
> > > 
> > > 
> > > GAME Stores Group Ltd has been awarded _Retailer of the Year_ at the 2006 Golden Joystick Awards and 
> > > 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
> > > 
> > > This e-mail and any files transmitted with it are confidential and intended solely for the use of the 
> > > individual or entity to whom they are addressed. If you have received this e-mail in error please 
> > > notify the system manager at:  
> > >  
> > >         mailto:postmaster at game.co.uk
> > >  
> > > The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore 
> > > THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of 
> > > any information contained in the message or assume any liability for it or for its transmission, reception or
> > > storage.  
> > > 
> > > This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of
> > > computer viruses. 
> > > http://www.game.co.uk
> > > http://www.gamegroup.plc.uk 
> > > 
> > > Registered Number: 1937170
> > > Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.
> 
> Please consider the environment before printing this email. 
> 
> 
> GAME Stores Group Ltd has been awarded ‘Retailer of the Year’ at the 2006 Golden Joystick Awards and 
> 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
> 
> This e-mail and any files transmitted with it are confidential and intended solely for the use of the 
> individual or entity to whom they are addressed. If you have received this e-mail in error please 
> notify the system manager at:  
>  
>         mailto:postmaster at game.co.uk
>  
> The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore 
> THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of 
> any information contained in the message or assume any liability for it or for its transmission, reception or storage.  
> 
> This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.
>  
> http://www.game.co.uk
> http://www.gamegroup.plc.uk 
> 
> Registered Number: 1937170
> Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.