# HG changeset patch
# User Carl Byington <carl@five-ten-sg.com>
# Date 1545669087 28800
# Node ID ae5e6bcc5017e6e8fb1269a840302c8a81681964
# Parent  5ae085b398f44ebf34ace0ee09cda25cddcccab7
sendmail auth failure detection for both login and plain methods

diff -r 5ae085b398f4 -r ae5e6bcc5017 syslog2iptables.conf.top
--- a/syslog2iptables.conf.top	Thu Feb 09 15:12:13 2017 -0800
+++ b/syslog2iptables.conf.top	Mon Dec 24 08:31:27 2018 -0800
@@ -85,7 +85,7 @@
         #    bucket 0;   // disable - iphone setup trips this; bucket 1800;
         #    message "sendmail pre-greeting";
         #};
-        pattern "authentication failure: checkpass failed, .*\[(.*)\]" {
+        pattern "authentication failure: .* failed, .*\[(.*)\]" {
             index 1;    // zero based
             bucket 100;
             message "sendmail authentication failed";
@@ -95,7 +95,7 @@
             bucket 100;
             message "dovecot failed password";
         };
-        pattern "dovecot.*Disconnected: Inactivity .auth failed.* rip=(.*), lip=" {
+        pattern "dovecot.*Disconnected.*auth failed.* rip=(.*), lip=" {
             index 1;    // zero based
             bucket 100;
             message "dovecot failed password";