I'm trying to build a filter myself using regex. This is a line i want to filter for example:

Aug 30 11:07:38 *** postfix/smtpd[17969]: connect from vps10685425.123-vps.co.uk[]

An this is my RegEx currently:

^%(__prefix_line).*:.*connect from.*\[<HOST>\].*$
^%(__prefix_line)s\w{14}:.*connect from[-._\w]+\[<HOST>\].*$

Both lines tell me

server.failregex.RegexException: No 'host' group in '/etc/fail2ban/filter.d/smtp-auth.conf'

Why does fail2ban fail to recognize the host group in my regex? what am I doing wrong here?

Thanks in advance :)

  • 1
    Did you try running fail2ban-regex in the command line? I did it with your log example and first regex and didn't get the host group error. – Paulo Almeida Aug 30 '16 at 10:25
  • Yes, the message occurs with the fail2ban-regex command but I added the mail.log and my config file. Maybe there is a problem with the config file? – mike.b93 Aug 30 '16 at 10:33
  • sheeeesh I'm with stupid here... I had a typo in my .conf file.. – mike.b93 Aug 30 '16 at 10:45
  • hehe good that it's solved. – Paulo Almeida Aug 30 '16 at 10:47

OK, abort mission. I'm the stupid one..

Got a Typo in my parameters... it is actually smtp_auth.conf not smtp-auth.conf

Sorry! Close this one and burry it deep -.-'

  • 3
    This actually helped me - the error message by fail2ban-regex does not explicitely say that the filter file does not exist, so I didn't notice at first that I uploaded the filter to the wrong server :-D – iquito Feb 26 '17 at 22:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.