# Fail2ban filter for SOGo authentcation
#
# Log file usually in /var/log/sogo/sogo.log

[Definition]

failregex = ^ sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for user '.*' might not have worked( - password policy: \d*  grace: -?\d*  expire: -?\d*  bound: -?\d*)?\s*$

ignoreregex = 

# 
# DEV Notes:
#
# The error log may contain multiple hosts, whereas the first one 
# is the client and all others are poxys. We match the first one, only
#
# Author: Arnd Brandes