fail2ban exim auth failure rule doesn't work

[James Swift]

The following rule - setup by default in fail2ban - to match failed exim4 authentication attempts doesn't ever match a real log entry:

^%(pid)s \w+ authenticator failed for (\S+ )?\(\S+\) \[<HOST>\](?::\d+)?(?: I=\[\S+\](:\d+)?)?: 535 Incorrect authentication data( \(set_id=.*\)|: \d+ Time\(s\))?\s*$

After trying it with fail2ban's own regex tester it always fails to match. I instead use a simpler rule:

\[<HOST>\]: 535 Incorrect authentication data

This needs to be fixed. Users naturally assume the default rules work, and even if they investigate the config it would appear to be valid. Only testing shows that the rule fails. How many users have a false sense of security because of this?

I haven't tested the other rules listed in "/etc/fail2ban/filter.d/exim.conf", but they may need adjusting too.

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: fail2ban 0.9.3-1
ProcVersionSignature: Ubuntu 4.4.0-66.87-generic 4.4.44
Uname: Linux 4.4.0-66-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.5
Architecture: amd64
Date: Thu Mar 16 22:35:32 2017
PackageArchitecture: all
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: fail2ban
UpgradeStatus: Upgraded to xenial on 2016-08-30 (197 days ago)
mtime.conffile..etc.fail2ban.filter.d.exim.conf: 2017-03-16T22:35:28.719416

[Seth Arnold (seth-arnold)]

Hi James, if you're in a position to be able to prepare updates it could be released via the SRU process. For more information please see https://wiki.ubuntu.com/StableReleaseUpdates .

Thanks

[James Swift (swiftscripts)]

I don't know enough about fail2ban to prepare an upgrade. My altered line works, but it may have edge cases that cause issues for other users. I was looking for feedback from experienced developers familiar with this package.