From 0c125ec9c93d70f81a5fb6a18b84a380e1099333 Mon Sep 17 00:00:00 2001 From: Anton Samets Date: Tue, 19 Mar 2024 22:30:45 +0300 Subject: [PATCH] filter.d/postfix.conf: add Sender address rejected: Malformed DNS server reply (#3590) * add Sender address rejected: Malformed DNS server reply --- config/filter.d/postfix.conf | 2 +- fail2ban/tests/files/logs/postfix | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/config/filter.d/postfix.conf b/config/filter.d/postfix.conf index 1e9e06f0e9..5497504e76 100644 --- a/config/filter.d/postfix.conf +++ b/config/filter.d/postfix.conf @@ -20,7 +20,7 @@ prefregex = ^%(__prefix_line)s> .+$ exre-user = |[Uu](?:ser unknown|ndeliverable address) ; pragma: codespell-ignore mdpr-normal = (?:\w+: (?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+) -mdre-normal=^%(_pref)s from [^[]*\[\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|Access denied|(?:Client host|Command|Data command) rejected|Relay access denied|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b +mdre-normal=^%(_pref)s from [^[]*\[\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|Access denied|(?:Client host|Command|Data command) rejected|Relay access denied|Malformed DNS server reply|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b ^from [^[]*\[\]%(_port)s:? mdpr-auth = warning: diff --git a/fail2ban/tests/files/logs/postfix b/fail2ban/tests/files/logs/postfix index da7f421986..bd0daf55fe 100644 --- a/fail2ban/tests/files/logs/postfix +++ b/fail2ban/tests/files/logs/postfix @@ -12,6 +12,8 @@ Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.1 Jul 18 23:12:56 xxx postfix/smtpd[1938]: NOQUEUE: reject: RCPT from unknown[192.0.2.236]: 554 5.7.1 : Helo command rejected: Access denied; from= to= proto=ESMTP helo= # failJSON: { "time": "2005-07-18T23:12:56", "match": true , "host": "192.51.100.43" } Jul 18 23:12:56 xxx postfix/smtpd[8738]: NOQUEUE: reject: RCPT from foo[192.51.100.43]: 554 5.7.1 : Sender address rejected: match bad.domain; from= to= proto=SMTP helo=<192.51.100.43> +# failJSON: { "time": "2005-07-18T23:12:57", "match": true , "host": "192.51.100.143", "desc": "gh-3590" } +Jul 18 23:12:57 xxx postfix/smtpd[8722]: NOQUEUE: reject: RCPT from foo[192.51.100.143]: 450 4.1.8 : Sender address rejected: Malformed DNS server reply; from= to= proto=SMTP helo=<192.51.100.143> # failJSON: { "time": "2005-08-10T10:55:38", "match": true , "host": "72.53.132.234" } Aug 10 10:55:38 f-vanier-bourgeois postfix/smtpd[2162]: NOQUEUE: reject: VRFY from 72-53-132-234.cpe.distributel.net[72.53.132.234]: 550 5.1.1 : Recipient address rejected: User unknown in local recipient tab # failJSON: { "time": "2005-08-13T15:45:46", "match": true , "host": "192.0.2.1" }