{"type":"rich","version":"1.0","provider_name":"phorkie","provider_url":"https:\/\/p.cweiske.de\/","title":"postfix\/smtpd[29302]: lost connection after AUTH from unknown[182.110.22.220]","author_name":"Christian Weiske","cache_age":86400,"width":900,"height":900,"html":"\n\n
\n
\n
\n 
Dec 13 15:44:24 ahso2 postfix\/smtpd[29302]: lost connection after AUTH from unknown[182.110.22.220]\r\n\r\ngrep 'lost connection after AUTH from' \/var\/log\/mail.log\r\n\r\nhttps:\/\/serverfault.com\/a\/705020\/75968<\/pre><\/div>\n\n <\/div>\n 
\n  view raw source<\/a>\n  phork0.txt<\/a>\n <\/div>\n<\/div>\n    
\n 
\n  
$ fail2ban-regex \/var\/log\/mail.log \/etc\/fail2ban\/filter.d\/postfix.conf \r\n\r\nRunning tests\r\n=============\r\n\r\nUse   failregex file : \/etc\/fail2ban\/filter.d\/postfix.conf\r\nUse         log file : \/var\/log\/mail.log\r\n\r\n\r\nResults\r\n=======\r\n\r\nFailregex: 6245 total\r\n|-  #) [# of hits] regular expression\r\n|   1) [163] ^\\s*(<[^.]+\\.[^.]+>)?\\s*(?:\\S+ )?(?:kernel: \\[ *\\d+\\.\\d+\\] )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?postfix\/smtpd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?postfix\/smtpd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)?\\s(?:\\[ID \\d+ \\S+\\])?\\s*NOQUEUE: reject: RCPT from \\S+\\[<HOST>\\]: 554 5\\.7\\.1 .*$\r\n|   5) [6082] ^\\s*(<[^.]+\\.[^.]+>)?\\s*(?:\\S+ )?(?:kernel: \\[ *\\d+\\.\\d+\\] )?(?:@vserver_\\S+ )?(?:(?:\\[\\d+\\])?:\\s+[\\[\\(]?postfix\/smtpd(?:\\(\\S+\\))?[\\]\\)]?:?|[\\[\\(]?postfix\/smtpd(?:\\(\\S+\\))?[\\]\\)]?:?(?:\\[\\d+\\])?:?)?\\s(?:\\[ID \\d+ \\S+\\])?\\s*lost connection after AUTH from \\S+\\[<HOST>\\]$\r\n<\/pre><\/div>\n\n <\/div>\n 
\n  view raw source<\/a>\n  testing.txt<\/a>\n <\/div>\n<\/div>\n<\/div>\n"}