dist: Update fail2ban filter

[bn4t]

Previously the fail2ban regex would only catch failed auth messages with a smtp/submission/lmtp/imap prefix.

This regex now also catches those without such a prefix.

I tested this on my maddy server where it worked well.

[foxcpp]

Missing module name prefix sounds like a bug, but quick grep does not reveal any messages without prefix (unless I missed something). Do you have a example when it is logged without prefix?

[bn4t]

Sure. They look like this:

authentication failed	{"reason":"no auth. provider accepted creds, last err: unknown credentials","src_ip":"<redacted>:12542","username":"<redacted>"}

I can't exactly tell when they're happening. In my log I see IMAP and SMTP Submission failures logged with the correct prefix.

[bn4t]

I think I found it. It seems to happen when using AUTH LOGIN. AUTH PLAINTEXT produces the correct error message.

[foxcpp]

Aha, you are right. Logger is not initialized properly for SASL-related code (AUTH PLAIN is handled separately). Regarding this PR, can you adjust regexp to not check prefix at all? I think it is not necessary. P.S. The message was supposed to have prefix submission/sasl: .

[bn4t]

Amended the commit. The regexp now no longer checks log prefixes.

[codecov-io]

Codecov Report

Merging #221 into dev will increase coverage by 0.03%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              dev     #221      +/-   ##
==========================================
+ Coverage   50.72%   50.75%   +0.03%     
==========================================
  Files         118      118              
  Lines        9240     9240              
==========================================
+ Hits         4687     4690       +3     
+ Misses       4045     4043       -2     
+ Partials      508      507       -1     

Flag	Coverage Δ
#integration	22.61% <ø> (ø)
#unit	56.69% <ø> (+0.04%)	⬆️

Impacted Files	Coverage Δ
internal/target/queue/timewheel.go	93.54% <0.00%> (-3.23%)	⬇️
internal/table/file.go	71.17% <0.00%> (+4.50%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d954353...2e883fb. Read the comment docs.

[foxcpp]

Thanks!