# Fail2Ban configuration file
#
# Author: Charles Josiah
# Email: charles.alandt@gmail.com
# Arquivo de configuracao do filtro do zimbra para fail2ban.
#
# Updated: 2020-01-30 - Em analise ainda....
# $Revision: 1 $
#
 
[Definition]
 
# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P[\w\-.^_]+)
# Values:  TEXT
#
failregex = \[ip=<HOST>;\] account - authentication failed for .* \(no such account\)$
            \[ip=<HOST>;\] security - cmd=Auth; .* error=authentication failed for .*, invalid password;$
 	    ;oip=<HOST>;.* unable to ldap authenticate: 80090308: LdapErr: DSID-0C09.*
            ;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$
            ;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .*, external LDAP auth failed, .*$
            ;oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, external LDAP auth failed, .*$
	    \[oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found$
            ;oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found .*$
            WARN .*;ip=<HOST>;ua=ZimbraWebClient .* security - cmd=AdminAuth; .* error=authentication failed for .*;$
            NOQUEUE: reject: RCPT from .*\[<HOST>\]: 550 5.1.1 .*: Recipient address rejected:
            upstream sent invalid response: .+ client: <HOST>:
            NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 554 5\.7\.1 .*$
	    NOQUEUE: reject: VRFY from \S+\[<HOST>\]: 550 5\.1\.1 .*$
	    NOQUEUE: reject: RCPT from \S+\[<HOST>\]: 454 4\.7\.1 :*$
	    reject: RCPT from (.*)\[<HOST>\]: 550 5.1.1
	    reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1
	    reject: RCPT from (.*)\[<HOST>\]: 554 5.7.1
	    reject: RCPT from unknown\[<HOST>\]: 454 4.7.1
	    warning: Illegal address syntax from unknown\[<HOST>\]
	    warning: non-SMTP command from unknown\[<HOST>\]:
	    connect from unknown\[<HOST>\]
	   .*;oip=<HOST>;.* security - cmd=Auth; .* error=authentication failed for .*;$
	   .*;oip=<HOST>;.* account - authentication failed for .* \(no such account\)$
	   .*;oip=<HOST>;.* security - cmd=Auth; .* error=authentication failed for .*, invalid password;$
	   .*;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .* invalid password;$
	   .*;oip=<HOST>;.* security - cmd=Auth; .* protocol=soap; error=authentication failed for .*, external LDAP auth failed, .*$
	   .*;oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, external LDAP auth failed, .*$
	   .*;oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found$
	   .*;oip=<HOST>;.* SoapEngine - handler exception: authentication failed for .*, account not found .*$
	   .* WARN  \[.*\] \[ip=.*;oip=<HOST>;via=.*;ua=.*;\] security - cmd=(?i)(Auth|AdminAuth); account=.*; protocol=.*; error=authentication failed.*, external LDAP.*$
	   .* WARN  \[.*:.*:.*:.*(?i)(AuthRequest)\]\ \[name=.*;ip=<HOST>;port=.*;ua=.*;\] security - cmd=(?i)(AdminAuth); account=.*; error=authentication failed.*
	   .* INFO  \[.*:.*:.*:.*(?i)(AuthRequest)\] \[oip=<HOST>;ua.*;] autoprov - unable to authenticate\ .*(?i)(AUTH_FAILED).*$
	   .* INFO  \[.*:.*:.*:.*(?i)(AuthRequest)\] \[oip=<HOST>;ua.*;] autoprov - unable to authenticate\ .*$
	    NOQUEUE: reject: RCPT from .*\[<HOST>\]: 550 5.1.1 .*: Recipient address rejected:
	   .*;oip=<HOST>;via=.*imap - authentication failed for.* 
           .* misc - Access from IP <HOST> suspended, for repeated failed login.
	   .*Imap.*ip=<HOST>;.*error=authentication failed for .*
	   .*Imap.*ip=<HOST>;.*account - authentication failed for .*
	   .*Pop.*ip=<HOST>;.*error=authentication failed for .*
           .*Pop.*ip=<HOST>;.*account - authentication failed for .*
	   .*ip=<HOST>;ua=zclient.*authentication failed for .*
           .*ip=<HOST>;port=.*;ua=ZimbraWebClient .* authentication failed for .*
           .*improper command pipelining after \S+ from [^[]*\[<HOST>\]:?$
          (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/ ]*)?$




#            .* upstream sent invalid response: '.*' \client: '<HOST>'\
#
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =
