From 62528756d65f6070659a8c9bf9106a90d8e558fc Mon Sep 17 00:00:00 2001 From: ale <ale@incal.net> Date: Sat, 17 Apr 2021 00:51:46 +0100 Subject: [PATCH] Fix example patterns for ipv6 --- example.patterns | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/example.patterns b/example.patterns index f7ebffd..98e83bf 100644 --- a/example.patterns +++ b/example.patterns @@ -4,23 +4,23 @@ ### SSH authentication failures # Silly brute-forcers that do not support our kex: -/^Unable to negotiate with ([.0-9]+) port \d+: no matching host key type found./ ssh +/^Unable to negotiate with ([.:0-9a-f]+) port \d+: no matching host key type found./ ssh ### Email-related rules # Postscreen failures - protocol errors are (in high volume) characteristic of spammers -/^NOQUEUE: reject: RCPT from \[([.0-9]+)\]:\d+: 550 5.5.1 Protocol error;/ spammer +/^NOQUEUE: reject: RCPT from \[([.:0-9a-f]+)\]:\d+: 550 5.5.1 Protocol error;/ spammer # Spammers trying to send email via disabled accounts -/^NOQUEUE: reject: RCPT from [^[]+\[(.[0-9]+)\]: 553 5.7.1 <[^>]+>: Sender address rejected: not owned by user/ spammer +/^NOQUEUE: reject: RCPT from [^[]+\[([.:0-9a-f]+)\]: 553 5.7.1 <[^>]+>: Sender address rejected: not owned by user/ spammer # Spammers triggering SPF failures -/^550 5.7.23 Message rejected due to: SPF fail - not authorized. Please see http:\/\/www.openspf.net\/Why?s=mfrom;id=[^;]*;ip=([.0-9]+);/ spammer +/^550 5.7.23 Message rejected due to: SPF fail - not authorized. Please see http:\/\/www.openspf.net\/Why?s=mfrom;id=[^;]*;ip=([.:0-9a-f]+);/ spammer ### Authentication # General auth-server errors -/^auth-server\[\d+\]: auth: user=.* service=smtp status=error ip=([.0-9]+) error=/ auth +/^auth-server\[\d+\]: auth: user=.* service=smtp status=error ip=([.:0-9a-f]+) error=/ auth ### Wordpress-specific rules -- GitLab