{"action":"opened","issue":{"url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1080","labels_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1080/labels{/name}","comments_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1080/comments","events_url":"https://api.github.com/repos/fail2ban/fail2ban/issues/1080/events","html_url":"https://github.com/fail2ban/fail2ban/issues/1080","id":91085251,"number":1080,"title":"Problem with filter matching for exim","user":{"login":"rivimey","id":1536678,"avatar_url":"https://avatars.githubusercontent.com/u/1536678?v=3","gravatar_id":"","url":"https://api.github.com/users/rivimey","html_url":"https://github.com/rivimey","followers_url":"https://api.github.com/users/rivimey/followers","following_url":"https://api.github.com/users/rivimey/following{/other_user}","gists_url":"https://api.github.com/users/rivimey/gists{/gist_id}","starred_url":"https://api.github.com/users/rivimey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rivimey/subscriptions","organizations_url":"https://api.github.com/users/rivimey/orgs","repos_url":"https://api.github.com/users/rivimey/repos","events_url":"https://api.github.com/users/rivimey/events{/privacy}","received_events_url":"https://api.github.com/users/rivimey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-06-25T21:49:47Z","updated_at":"2015-06-25T21:49:47Z","closed_at":null,"body":"I am trying to make some failregexes for my exim4 setup, and although I've added several that work fine, my acl matches don't, and I was hoping you could help.\r\n\r\nFor the moment I've merged exim-spam with exim, and the result follows:\r\n\r\n    [INCLUDES]\r\n\r\n    # Read common prefixes. If any customizations available -- read them from\r\n    # exim-common.local\r\n    before = exim-common.conf\r\n\r\n    [Definition]\r\n\r\n    failregex = ^%(pid)s %(host_info)ssender verify fail for <\\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\\s*$\r\n                ^%(pid)s (plain|login|LOGIN|PLAIN) authenticator failed for (\\S+ )?\\(\\S+\\) \\[<HOST>\\]: 535 Incorrect authentication data( \\(set_id=.*\\)|: \\d+ Time\\(s\\))?\\s*$\r\n                ^%(pid)s %(host_info)sF=(<>|[^@]+@\\S+) rejected RCPT [^@]+@\\S+: (relay not permitted|Sender verify failed|Unknown user)\\s*$\r\n                ^%(pid)s %(host_info)sF=(<>|[^@]+@\\S+) rejected RCPT [^@]+@\\S+: .*dnsbl.*\\s*$\r\n                ^%(pid)s %(host_info)sF=(<>|[^@]+@\\S+) rejected after DATA: This message contains a virus \\(\\S+\\)\\.\\s*$\r\n                ^%(msgid)s H=\\S+ (\\(\\S+\\) )?\\[<HOST>\\] F=\\S+ rejected after DATA: Your message scored\r\n                ^%(pid)s %(host_info)sF=(<>|[^@]+@\\S+) rejected after DATA: Your message scored \\d+\\.\\d+ SpamAssassin points. Report follows:\r\n                ^\\S+ F=(<>|\\S+@\\S+) %(host_info)srejected by local_scan\\(\\): .{0,256}$\r\n                ^%(pid)s TLS error on connection from (\\(\\S+\\) )?\\[<HOST>\\] \\((gnutls_handshake|recv|send)\\):\r\n                ^%(pid)s SMTP protocol synchronization error \\([^)]*\\): rejected (connection from|\"\\S+\") %(host_info)s(next )?input=\".*\"\\s*$\r\n                ^%(pid)s SMTP call from \\S+ \\[<HOST>\\](:\\d+)? (I=\\[\\S+\\]:\\d+ )?dropped: too many nonmail commands \\(last was \"\\S+\"\\)\\s*$\r\n                ^%(pid)s no host name found for IP address <HOST>\r\n                Connection from \\[<HOST>\\] refused: too many connections\r\n\r\n    ignoreregex = (Start|End) queue run: pid=\\d+\r\n                %(msgid)s Completed$\r\n                %(msgid)s DKIM: (d=\\S+ )?(s=\\S+ )?(c=\\S+ )?(a=\\S+ )?(i=\\S+ )?(t=\\d+ )?(x=\\d+ )?\\[verification succeeded\\]\r\n                %(msgid)s DKIM: (d=\\S+ )?(s=\\S+ )?(c=\\S+ )?(a=\\S+ )?(i=\\S+ )?(t=\\d+ )?(x=\\d+ )?\\[verification failed - signature did not verify \\(headers probably modified in transit\\)\\]\r\n                %(msgid)s H=\\S+ \\[<HOST>\\] Warning: Message is missing the Message-ID header.\r\n                %(msgid)s H=\\S+ \\[<HOST>\\] F=\\S+ temporarily rejected after DATA: Greylisted\r\n                %(msgid)s H=\\S+ \\[<HOST>\\] F=\\S+ rejected after DATA: Missing header lines\r\n                %(msgid)s =>\r\n                %(msgid)s <=\r\n                %(msgid)s greylist lookup returned \"[^\"]*\"\r\n\r\n\r\nThis is an extract from the logs I'm parsing:\r\n\r\n    2015-06-16 08:19:04 H=212-129-4-178.rev.poneytelecom.eu (WIN-CNJRTE1IMGI) [212.129.4.178] F=<test@ivimey.org> rejected RCPT <asantiago.cat@gmail.com>: relay not permitted\r\n    2015-06-16 08:19:04 unexpected disconnection while reading SMTP command from 212-129-4-178.rev.poneytelecom.eu (WIN-CNJRTE1IMGI) [212.129.4.178]\r\n    2015-06-16 08:19:06 H=212-129-4-178.rev.poneytelecom.eu (WIN-CNJRTE1IMGI) [212.129.4.178] F=<info@ivimey.org> rejected RCPT <asantiago.cat@gmail.com>: relay not permitted\r\n    2015-06-16 08:19:06 unexpected disconnection while reading SMTP command from 212-129-4-178.rev.poneytelecom.eu (WIN-CNJRTE1IMGI) [212.129.4.178]\r\n    2015-06-16 08:21:24 1Z4lBU-0000TD-Fh DKIM: d=yahoogroups.com s=echoe c=relaxed/relaxed a=rsa-sha256 t=1434439281 [verification succeeded]\r\n    2015-06-16 08:21:25 1Z4lBU-0000TD-Fh <= sentto@groups.yahoo.com H=ng14-ip2.bullet.mail.bf1.yahoo.com [98.139.165.118] P=esmtps X=TLS1.0:RSA_ARCFOUR_SHA1:128 S=10543 id=mloipg+1lqc80p@YahooGroups.com\r\n    2015-06-16 08:21:25 1Z4lBU-0000TD-Fh => ruth <~~~~@~~~~ey.org> R=localuser_~~~~~~~~~ T=imap_delivery\r\n    2015-06-16 08:21:25 1Z4lBU-0000TD-Fh Completed\r\n    2015-06-16 08:31:49 Start queue run: pid=1963\r\n    2015-06-16 08:31:49 End queue run: pid=1963\r\n    2015-06-16 08:37:34 no host name found for IP address 89.136.106.118\r\n    2015-06-16 08:37:37 1Z4lRA-0000Wo-M9 H=([89.136.106.118]) [89.136.106.118] F=<overseastravel@caravanclub.co.uk> rejected after DATA: Your message scored 6.6 SpamAssassin points. Report follows:\r\n    2015-06-16 08:56:31 1Z4ljS-0000an-QB DKIM: d=remaxlaketravis.com s=dkim c=relaxed/relaxed a=rsa-sha1 i=trackr_bravo@remaxlaketravis.com [verification succeeded]\r\n    2015-06-16 08:56:34 1Z4ljS-0000an-QB H=(mail.remaxlaketravis.com) [89.42.132.163] F=<trackr_bravo-ruth=ivimey.org@remaxlaketravis.com> rejected after DATA: Your message scored 14.7 SpamAssassin points. Report follows:\r\n    2015-06-16 09:01:49 Start queue run: pid=2447\r\n    2015-06-16 09:01:49 End queue run: pid=2447\r\n    2015-06-16 09:12:13 1Z4lyb-0000hI-AR <= jack.marsh@vividresourcing.com H=eu-smtp-delivery-181.mimecast.com [207.82.80.181] P=esmtps X=TLS1.0:RSA_AES_256_CBC_SHA1:256 S=7305 id=AABC54957095F54888A055CA6D5A95D316FBA87A@V2012EX.vivid.local\r\n    2015-06-16 09:12:13 1Z4lyb-0000hI-AR => ruth <~~~~@~~~~ey.org> R=localuser_~~~~~~~~~ T=imap_delivery\r\n    2015-06-16 09:12:13 1Z4lyb-0000hI-AR Completed\r\n    2015-06-16 09:25:58 1Z4mBv-0000kp-RM H=(dsl-188-34-243-249.asretelecom.net) [188.34.243.249] F=<kathy@almondscateringsupplies.co.uk> rejected after DATA: Your message scored 11.7 SpamAssassin points. Report follows:\r\n\r\n\r\nI'm calling it using:\r\n\r\n    fail2ban-regex  /tmp/log filter.d/exim.conf filter.d/exim.conf\r\n\r\n"}}