<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Manuel,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mille Grazia!</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
That is exactly what I was looking for. Are you OK if I give you and Studio Storti some credit in my upcoming blog post on this subject?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
All the best,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Mark<br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
P.S. Please say hello to Paolo, Alberto and Cine for me!<br>
</div>
<div id="Signature">
<div></div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px"><strong>_________________________________________________</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><strong>L. Mark Stone</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><br>
</p>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Manuel Garbin <manuel@studiostorti.com><br>
<b>Sent:</b> Wednesday, June 3, 2020 1:30 AM<br>
<b>To:</b> L Mark Stone <lmstone@lmstone.com><br>
<b>Cc:</b> users <users@lists.zetalliance.org><br>
<b>Subject:</b> Re: [Users] Help Request: Fail2ban for SASL-Auth Only</font>
<div> </div>
</div>
<div>
<div style="font-family:arial,helvetica,sans-serif; font-size:12pt; color:#000000">
<div><style style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style></div>
<div>Hi Mark,<br>
</div>
<div>here we go whit this regexp:<br>
</div>
<div><br>
</div>
<div>grep -P 'postfix\/submission\/smtpd\[\d+\]: warning: .*\[(.*)\]: SASL \w+ authentication failed: authentication failure$' /var/log/zimbra.log</div>
<div><br>
</div>
<div>This will match only submission port.<br>
</div>
<div>On fail2ban you need a new filter with this rule like this :<br>
</div>
<div><br>
</div>
<div>failregex = postfix\/submission\/smtpd\[\d+\]: warning: .*\[<HOST>\]: SASL \w+ authentication failed: authentication failure$<br>
<br>
</div>
<div><br>
</div>
<hr id="x_zwchr">
<div>
<blockquote style="border-left:2px solid #1010FF; margin-left:5px; padding-left:5px; color:#000; font-weight:normal; font-style:normal; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-size:12pt">
<b>Da: </b>"L Mark Stone" <lmstone@lmstone.com><br>
<b>A: </b>"users" <users@lists.zetalliance.org><br>
<b>Inviato: </b>Marted́, 2 giugno 2020 23:13:54<br>
<b>Oggetto: </b>[Users] Help Request: Fail2ban for SASL-Auth Only<br>
</blockquote>
</div>
<div>
<blockquote style="border-left:2px solid #1010FF; margin-left:5px; padding-left:5px; color:#000; font-weight:normal; font-style:normal; text-decoration:none; font-family:Helvetica,Arial,sans-serif; font-size:12pt">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Regular expressions are a weak point with me and I've got DoSFilter working just fine already.
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
What I'm looking to do is implement Fail2ban -- but just for SASL-Auth failures on port 587, and leave DoSFilter keeping watch on mailboxd.<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I've looked at a number of older Zimbra-fail2ban web sites, and none of the regex's there seem to match what I see in my logs for SASL-Auth failures.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
If anyone has pointers to newer Zimbra fail2ban guides, especially if they work with Ubuntu's UFW, I'd be grateful.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks in advance,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Mark<br>
</div>
<div>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p style="margin-top:0px; margin-bottom:0px"><strong>_________________________________________________</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><strong>L. Mark Stone</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><strong>Mission Critical Email LLC</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><strong>mark.stone@missioncriticalemail.com<br>
</strong></p>
<p style="margin-top:0px; margin-bottom:0px"><br>
</p>
</div>
</div>
</div>
<br>
</blockquote>
</div>
</div>
</div>
</body>
</html>