# failed logins from a single address before ban
# uncomment to override conf.bfd trig value
TRIG="50"

# file must exist for rule to be active
REQ="/usr/sbin/postfix"

if [ -f "$REQ" ]; then
	LP="/var/log/mail.log"
	TLOG_TF="postfix"

	## Postfix dictionary attacks
	ARG_VAL=`$TLOG_PATH $LP $TLOG_TF | grep -iwE "SASL LOGIN authentication failed:|SASL PLAIN authentication failed:" | grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | awk -F '[' '{ print $3 }' | tr -d '[a-z][A-Z]\[\]\:'`
fi
