# failed logins from a single address before ban
# uncomment to override conf.bfd trig value
TRIG="50"

# file must exist for rule to be active
REQ="/usr/sbin/exim"

if [ -f "$REQ" ]; then
	LP="/var/log/exim/mainlog"
	TLOG_TF="exim2"

	## EXIM attacks
	ARG_VAL=`$TLOG_PATH $LP $TLOG_TF | grep -E "login authenticator failed for" | grep -E "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | tr -d '[]' | sed -n -e 's/.*login authenticator failed for \([^ ]*\) .* \([\.0-9]*\): 535 Incorrect authentication data.*/\2:\1/p'`
fi
