# Fail2ban filter for Limristem eMail API/panel authentication failures.
# Matches journal lines from limristem-mail.service (uvicorn/python).

[Definition]
failregex = ^.*authentication failure.*client[=:]?\s*<HOST>.*$
            ^.*Too many authentication attempts.*client[=:]?\s*<HOST>.*$
            ^.*Unauthorized.*<HOST>.*$
            ^.*Invalid or expired access token.*from\s+<HOST>.*$
            ^.*rate.?limit.*blocked.*<HOST>.*$
            ^.*login failed.*ip[=: ]+<HOST>.*$
            ^.*auth failed.*from\s+<HOST>.*$

ignoreregex =

datepattern = {^LN-BEG}
journalmatch = _SYSTEMD_UNIT=limristem-mail.service