[Dovecot] Audit log?

[Rob Coward]

Yes, but surely its not a big leap for you to rewrite my regex to:

auth\(default\): sql\(.*,<HOST>\): Password mismatch

Rob

On Fri, 2007-12-21 at 16:30 +0100, Bjørn T Johansen wrote:
> Yes, but that doesn't work for sql auth; as you see, the line logged is different...
> 
> BTJ
> 
> On Fri, 21 Dec 2007 14:32:01 +0000
> Rob Coward <rob.coward at game.co.uk> wrote:
> 
> > I use pam authentication in dovecot and the following fail2ban filter
> > seems to work fine for me:
> > 
> > failregex = auth\(default\): pam\(.*,<HOST>\): pam_authenticate\(\)
> > failed:
> > 
> > Rob
> > 
> > On Fri, 2007-12-21 at 12:04 +0100, Bj__rn T Johansen wrote:
> > 
> > > On Thu, 20 Dec 2007 18:42:01 +0200
> > > Timo Sirainen <tss at iki.fi> wrote:
> > > 
> > > > On Thu, 2007-12-20 at 13:18 +0100, Bj__rn T Johansen wrote:
> > > > > Yes, I know about those but I was kind of hoping to see failed authentications in some logs without
> > > > > enabling debug logging, like if I use PAM authentication....
> > > > 
> > > > auth_verbose=yes enables logging failed logins.
> > > > 
> > > 
> > > That did the trick... thx... :)
> > > 
> > > If I only had learned regexp like I have been meaning too for many years now, this would have been a piece of
> > > cake but...
> > > 
> > > Does anyone use Dovecot together with fail2ban? If so, could any one share the failregex they are using? (A)
> > > (or perhaps someone could create a regexp that recognize a line like this:
> > > 
> > > dovecot: Dec 21 11:58:07 Info: auth(default): sql(btj at havleik.no,85.19.143.23): Password mismatch
> > > 
> > > )
> > > 
> > > 
> > > BTJ
> > 
> > 
> > Please consider the environment before printing this email. 
> > 
> > 
> > GAME Stores Group Ltd has been awarded _Retailer of the Year_ at the 2006 Golden Joystick Awards and 
> > 'Thames Valley Business Award' for Outstanding Employer of Choice 2006.
> > 
> > This e-mail and any files transmitted with it are confidential and intended solely for the use of the 
> > individual or entity to whom they are addressed. If you have received this e-mail in error please 
> > notify the system manager at:  
> >  
> >         mailto:postmaster at game.co.uk
> >  
> > The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore 
> > THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of 
> > any information contained in the message or assume any liability for it or for its transmission, reception or
> > storage.  
> > 
> > This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of
> > computer viruses. 
> > http://www.game.co.uk
> > http://www.gamegroup.plc.uk 
> > 
> > Registered Number: 1937170
> > Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.

Please consider the environment before printing this email. 


GAME Stores Group Ltd has been awarded ‘Retailer of the Year’ at the 2006 Golden Joystick Awards and 
'Thames Valley Business Award' for Outstanding Employer of Choice 2006.

This e-mail and any files transmitted with it are confidential and intended solely for the use of the 
individual or entity to whom they are addressed. If you have received this e-mail in error please 
notify the system manager at:  
 
        mailto:postmaster at game.co.uk
 
The recipient acknowledges that the transmissions made via the Internet can be corrupted and therefore 
THE GAME GROUP PLC and any of its subsidiaries do not give any warranty as to the quality or accuracy of 
any information contained in the message or assume any liability for it or for its transmission, reception or storage.  

This footnote also confirms that this e-mail message has been swept by anti-virus software for the presence of computer viruses.
 
http://www.game.co.uk
http://www.gamegroup.plc.uk 

Registered Number: 1937170
Registered Office: Unity House, Telford Road, Basingstoke, Hampshire. RG21 6YJ Registered in England and Wales.