Initial commit

files/fail2ban/postfix-sasl.conf

@@ -0,0 +1,7 @@
+[sasl]
+enabled  = true
+findtime = 3600
+bantime  = 3600
+port     = submission
+filter   = postfix-sasl
+logpath  = /var/log/mail-sasl.log

files/fail2ban/postfix-sasl.local

@@ -0,0 +1,21 @@
+# Fail2Ban filter for postfix authentication failures
+#
+
+[INCLUDES]
+
+before = common.conf
+
+[Definition]
+
+_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]
+
+failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/:]*={0,2})?\s*$
+
+ignoreregex = authentication failed: Connection lost to authentication server$
+
+[Init]
+
+journalmatch = _SYSTEMD_UNIT=postfix.service
+
+
+# Author: Yaroslav Halchenko