diff options
| author | Jonas Smedegaard <dr@jones.dk> | 2005-12-15 10:12:21 +0000 |
|---|---|---|
| committer | Jonas Smedegaard <dr@jones.dk> | 2005-12-15 10:12:21 +0000 |
| commit | bbce308fe2b1f48db8cf2e3de148f00a46af9d50 (patch) | |
| tree | f306d122a58ed6c4a7c552d5ea69bff9348809bd /logcheck/violations.ignore.d | |
| parent | 350bf8d1ebb676b7378ebe4af9a1f0978191f2ac (diff) | |
Ignore another postfix dyndns blocking. Ignore illegal SSH logins also for SSHv1
Diffstat (limited to 'logcheck/violations.ignore.d')
| -rw-r--r-- | logcheck/violations.ignore.d/local | 2 | ||||
| -rw-r--r-- | logcheck/violations.ignore.d/postfix | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/logcheck/violations.ignore.d/local b/logcheck/violations.ignore.d/local index 78a8682..6814f49 100644 --- a/logcheck/violations.ignore.d/local +++ b/logcheck/violations.ignore.d/local @@ -55,7 +55,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: certificate peer name verification failed for [^[:space:]]+: (CommonName mis-match: .+|[0-9]+ dNSNames in certificate found, but none matches)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: certificate verification failed for [^[:space:]]+:( num=10:)?certificate has expired$ -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused (mail service|to talk to me: ([^[:space:]]+ +(550 ERROR: Mail Refused - [\.0-9]+ - See [^[:space:]]+|554 #5\.5\.4 Relaying denied\. IP name lookup failed)|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic\.reject\)))) +\(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused (mail service|to talk to me: ([^[:space:]]+ +(550 <[^[:space:]]+>: Client host rejected: Blocked|550 ERROR: Mail Refused - [\.0-9]+ - See [^[:space:]]+|554 #5\.5\.4 Relaying denied\. IP name lookup failed)|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic\.reject\)))) +\(port 25\)$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/qmgr\[[0-9]+\]: [^[:space:]]+: to=<[^>]*>, relay=none, delay=[0-9]+, status=deferred \(delivery temporarily suspended: host [^[:space:]]+\[[\.0-9]+\] refused to talk to me: ([^[:space:]]+ 550 ERROR: Mail Refused - [\.0-9]+ - See http://security.rr.com/mail_blocks.htm\)|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic.reject\))$ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: [^[:space:]]+: host [^[:space:]]+\[[\.0-9]+\] refused to talk to me: ([^[:space:]]+ 550 ERROR: Mail Refused - [\.0-9]+ - See http://security.rr.com/mail_blocks.htm|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic.reject\)|554 <[^[:space:]]+\[[\.0-9]+\]>: Client host rejected: No mail accepted from you)$ diff --git a/logcheck/violations.ignore.d/postfix b/logcheck/violations.ignore.d/postfix index 5eda3af..699a360 100644 --- a/logcheck/violations.ignore.d/postfix +++ b/logcheck/violations.ignore.d/postfix @@ -14,7 +14,7 @@ ^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: certificate verification failed for [^[:space:]]+:( num=10:)?certificate has expired$ # Too much spam refuse to eat their own shit -^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused (mail service|to talk to me: ([^[:space:]]+ +(550 ERROR: Mail Refused - [\.0-9]+ - See [^[:space:]]+|554 #5\.5\.4 Relaying denied\. IP name lookup failed)|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic\.reject\)))) +\(port 25\)$ +^\w{3} [ :0-9]{11} [._[:alnum:]-]+ postfix/smtp\[[0-9]+\]: connect to [^[:space:]]+\[[\.0-9]+\]: (Connection refused|server refused (mail service|to talk to me: ([^[:space:]]+ +(550 <[^[:space:]]+>: Client host rejected: Blocked|550 ERROR: Mail Refused - [\.0-9]+ - See [^[:space:]]+|554 #5\.5\.4 Relaying denied\. IP name lookup failed)|550 Host [\.0-9]+ is reject as in dynamic reject list \(dynamic\.reject\)))) +\(port 25\)$ # Ignore blacklisting due to being dynamic - or without explaining/hinting at all ## Grr - could've been a single rule if only logcheck supported custom classes |