Home / server / Questions / 805119
Accepted
John Steave
Asked: 2016-09-25 08:25:58 +0800 CST

fail2ban - block from mail.log "SSL_accept error from"

  • 772

i would like to block IP address with fail2ban if in postfix mail log is line:

SSL_accept error from unknown[xxx.xxx.xxx.xxx]: lost connection

i try make fail2ban ssl_error.conf in filter.d with this line:

failregex = ^%(__prefix_line)sSSL_accept error from \S+\s*\[<HOST>\]: lost connection$

but no luck :(

fail2ban

1 Answers

  1. Best Answer

    Get rid of the ^%(__prefix_line)s part. Simply set

    failregex = SSL_accept error from \S+\s*\[<HOST>\]: lost connection
    • 0