Fail2Ban and Postfix SASL

A quick note about the postfix-sasl jail in Fail2Ban.  It was failing to match some log entries from my postfix install.  Its regex contains the following:

SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5)

I had to modify it to:

SASL (?:login|LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5)

due to my log sometimes containing the lower case ‘login’

Leave a Reply

Your email address will not be published. Required fields are marked *