Edit File: qmail.conf
# Fail2Ban filters for qmail RBL patches/fake proxies # # the default djb RBL implementation doesn't log any rejections # so is useless with this filter. # # One patch is here: # # http://www.tjsi.com/rblsmtpd/faq/ patch to rblsmtpd [INCLUDES] before = common.conf [Definition] _daemon = (?:qmail|rblsmtpd) failregex = ^%(__prefix_line)s\d+\.\d+ rblsmtpd: <HOST> pid \d+ \S+ 4\d\d \S+\s*$ ^%(__prefix_line)s\d+\.\d+ qmail-smtpd: 4\d\d badiprbl: ip <HOST> rbl: \S+\s*$ ^%(__prefix_line)s\S+ blocked <HOST> \S+ -\s*$ ignoreregex = # DEV Notes: # # These seem to be for two or 3 different patches to qmail or rblsmtpd # so you'll probably only ever see one of these regex's that match. # # ref: https://github.com/fail2ban/fail2ban/pull/386 # # Author: Daniel Black