postfix-sasl-abuse.conf

# Fail2Ban filter for postfix authentication abuse
# Find good smtpd sasl authentification and ban the IP in case of abuse (33*MaxRetry)
# author stephane de Labrusse <stephdl@de-labrusse.fr>

[INCLUDES]

before = common.conf

[Definition]

_daemon = postfix(-\w+)?/(?:submission/|smtps/)?smtp[ds]

failregex = ^%(__prefix_line)s.*\[<HOST>\], sasl_method=(LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5), sasl_username=\S+$

ignoreregex =

[Init]

journalmatch = _SYSTEMD_UNIT=postfix.service