add dovecot as postfix auth backend parsing

2026-04-28 10:23:35 +00:00 · 2019-04-08 23:28:14 +02:00
parent e4b3977704
commit 43998632aa
1 changed files with 12 additions and 0 deletions
--- a/data/dovecot.json
+++ b/data/dovecot.json
@@ -0,0 +1,12 @@
+[
+  {
+    "filter": "SYSLOG_IDENTIFIER=auth",
+    "items": [
+      {
+        "ban": 50,
+        "score": 0.6,
+        "pattern": "MESSAGE=pam_unix[(]dovecot:auth[)]: authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=.*@.* rhost=([0-9a-z:.]+)"
+      }
+    ]
+  }
+]