# Fail2Ban filter for postfix authentication failures
[INCLUDES]
before = common.conf

[Definition]
_daemon = postfix/smtpd
#failregex = ^%(__prefix_line)swarning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [ A-Za-z0-9+/]*={0,2})?\s*$
failregex = warning: .*\[<HOST>\]: SASL LOGIN authentication failed
            improper command pipelining after CONNECT from .*\[<HOST>\]:
ignoreregex =
