fail2ban uses this for exim:
[exim-iptables]
enabled = true
filter = exim
action = hestia[name=MAIL]
logpath = /var/log/exim4/mainlog
exim filter uses this regex:
failregex = ^%(pid)s %(host_info)ssender verify fail for <\S+>: (?:Unknown user|Unrouteable address|all relevant MX records point to non-existent hosts)\s*$ ^%(pid)s \w+ authenticator failed for (?:[^[( ]* )?(?:(\S*) )?[](?::\d+)?(?: I=[\S+](:\d+)?)?: 535 Incorrect authentication data( (set_id=.)|: \d+ Time(s))?\s$ ^%(pid)s %(host_info)srejected RCPT [^@]+@\S+: (?:relay not permitted|Sender verify failed|Unknown user|Unrouteable address)\s*$ ^%(pid)s SMTP protocol synchronization error ([^)]): rejected (?:connection from|"\S+") %(host_info)s(?:next )?input="."\s*$ ^%(pid)s SMTP call from (?:[^[( ]* )?%(host_info)sdropped: too many (?:nonmail commands|syntax or protocol errors) (last (?:command )?was “[^”]")\s$ ^%(pid)s SMTP protocol error in “[^”]+(?:"+[^"](?="))?" %(host_info)sAUTH command used when not advertised\s*$ ^%(pid)s no MAIL in SMTP connection from (?:[^[( ]* )?(?:(\S*) )?%(host_info)sD=\d\Ss(?: C=\S)?\s*$ ^%(pid)s (?:[\w-]+ )?SMTP connection from (?:[^[( ]* )?(?:(\S*) )?%(host_info)sclosed by DROP in ACL\s*$ <mdre-> mdre-aggressive = ^%(pid)s no host name found for IP address $ ^%(pid)s no IP address found for host \S+ (during SMTP connection from [])$
That regex is not in mainlog but reject log. So should’t exim in f2b be:
[exim-iptables]
enabled = true
filter = exim
action = hestia[name=MAIL]
logpath = /var/log/exim4/rejectlog
?? or am I missing something