From 2811b498abed136fbaacb3f14dceaa466bfdf41d Mon Sep 17 00:00:00 2001 From: andryyy Date: Sat, 12 Oct 2019 13:15:59 +0200 Subject: [PATCH] [Netfilter] Punish failed logins to /rspamd --- data/Dockerfiles/netfilter/server.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/Dockerfiles/netfilter/server.py b/data/Dockerfiles/netfilter/server.py index 51d78a0a..e923bbd9 100644 --- a/data/Dockerfiles/netfilter/server.py +++ b/data/Dockerfiles/netfilter/server.py @@ -35,7 +35,8 @@ RULES[3] = '-login: Aborted login \(tried to use disallowed .+\): user=.+, rip=( RULES[4] = 'SOGo.+ Login from \'([0-9a-f\.:]+)\' for user .+ might not have worked' RULES[5] = 'mailcow UI: Invalid password for .+ by ([0-9a-f\.:]+)' RULES[6] = '([0-9a-f\.:]+) \"GET \/SOGo\/.* HTTP.+\" 403 .+' -#RULES[7] = '-login: Aborted login \(no auth .+\): user=.+, rip=([0-9a-f\.:]+), lip.+' +RULES[7] = 'Rspamd UI: Invalid password by ([0-9a-f\.:]+)' +#RULES[8] = '-login: Aborted login \(no auth .+\): user=.+, rip=([0-9a-f\.:]+), lip.+' WHITELIST = [] BLACKLIST= []