Hi All

I have fail2ban running on a Ubuntu 12.4 server with Zimbra. I have created some filters etc, to block failed login attempts and ban the user.

The issue I have here is that with the new item's I have put in jail.conf, I don't get any who is data. I just get an emails saying it's banned and the ip. The other standard items in jail.conf work fine.

I understand I need to put %(action_mwl)s but don't know where I should put this in my config below, as each time I try fail2ban fails to start

[zimbra-account]

enabled = true
filter = zimbra
action = iptables-allports[name=Zimbra-account]
sendmail[name=Zimbra-account, dest=email@user.com]
logpath = /opt/zimbra/log/mailbox.log
bantime = -1
maxretry = 5

Any advise here would be great, thanks

Glenn

Version of fail2ban please?
Also, you should put all your edits in /etc/fail2ban/jail.local to preserve against loss during an update|upgrade.

stock fail2ban package has a sasl filter. look for it in /etc/fail2ban/filters.d/*