ConfigServer Community Forum

Yes! The SETID custom regex rule is working now! It blocked one during the night. Thank you Sergio.

Sergio wrote:That means it worked?

I don't know yet, but will let you know.

Thank you Sergio!

So changing |xerox)\)/)) to |xerox)\@/)) will match any domain name after the @ that has one of the setids listed in the array?

As I said before, you have to modify the regex for this to work, replace this: /\S+\s+\S+\s+dovecot_login authenticator failed for \(\[?\S+\]?\) \[(\S+)\]:\d+: \d+ Incorrect authentication data \(set_id= by this: /\S+\s+\S+\s+.*_login authenticator failed for.*\(\[?\S+\]?\) \[(\S+)\]:\d+.*Incorrect...

Sergio I may have spoke too soon. It seems that dovecot logs slightly different for the set_id failures than courier did on my server. Would you take a look at these two log lines from failed set_id logins and see if you can adapt your SETID custom rule to it? 2015-06-16 16:01:56 [31120] dovecot_log...

Sergio, everything works fine! The modified rules worked for courier, and yesterday I converted to dovecot and they work for dovecot also!

Thank you very much for your help.

I just made them so it is too early to tell yet.

The YLMF-PC change you gave me yesterday works!

Thank you Sergio, very much!

Here is a log line from exim+rejectlog with set_id in it: 2015-06-10 04:24:23 [28631] courier_login authenticator failed for lt57-196.hrz.tu-darmstadt.de (LT57-196) [130.83.57.196]:59107 I=[69.xxx.xxx.xxx]:587: 535 Incorrect authentication data (set_id=apple) Here are two for "no such address h...