12 lines
934 B
Text
12 lines
934 B
Text
Index: src/parser/attack_scanner.l
|
|
--- src/parser/attack_scanner.l.orig
|
|
+++ src/parser/attack_scanner.l
|
|
@@ -249,7 +249,7 @@ HTTP_LOGIN_200OK_BAD .*({WORDPRESS_LOGIN}|{TYPO3
|
|
<sendmail_authfailure>"]".* { BEGIN(INITIAL); return SENDMAIL_AUTHFAILURE_SUFF; }
|
|
|
|
/* dovecot */
|
|
-("(libdovecot."[0-9\.]+".dylib) ")?(imap|pop3|submission)"-login: ""Info: "?("Aborted login"|Disconnected).*" (auth failed, "{NUMBER}" attempts".*"): ".+" rip=" { BEGIN(dovecot_loginerr); return DOVECOT_IMAP_LOGINERR_PREF; }
|
|
+("(libdovecot."[0-9\.]+".dylib) "|"dovecot: ")?(imap|pop3|submission)"-login: ""Info: "?("Aborted login"|Disconnected).*" (auth failed, "{NUMBER}" attempts".*"): ".+" rip=" { BEGIN(dovecot_loginerr); return DOVECOT_IMAP_LOGINERR_PREF; }
|
|
<dovecot_loginerr>", lip=".+ { BEGIN(INITIAL); return DOVECOT_IMAP_LOGINERR_SUFF; }
|
|
|
|
/* UWimap login errors */
|