ERROR

----

ERROR

Aug 30 15:22:17 mail dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=80.82.77.33, lip=103.76.149.106, session=<6i58nKN0jgBQUk0h>

Aug 30 15:22:17 mail dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=80.82.77.33, lip=103.76.149.106, session=<tX6BnKN0lABQUk0h>

Please consider modify the dovecot regex

# vi /etc/fail2ban/filter.d/dovecot.conf

^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$

Change the line:

^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? \(((auth failed, \d+ attempts|no auth attempts)( in \d+ secs)?|tried to use (disabled|disallowed) \S+ auth)\):( user=<\S*>,)?( method=\S+,)? rip=<HOST>(, lip=(\d{1,3}\.){3}\d{1,3})?(, TLS( handshaking(: SSL_accept\(\) failed: error:[\dA-F]+:SSL routines:[TLS\d]+_GET_CLIENT_HELLO:unknown protocol)?)?(: Disconnected)?)?(, session=<\S+>)?\s*$

------