Hi to all,

I just encountered an attack. I was wondering why fail2ban didn't catch it.  The attacker used alphabetic user name. The regex detects numeric digits only.  As a quick fix I modified the filter portion:

            ^\.\d+ \[WARNING\] sofia_reg\.c:\d+ Can't find user \[\d+@\d+\.\d+\.\d+\.\d+\] from <HOST>$

TO: ...  Can't find user \[.+@\d+\.\d+\.\d+\.\d+\] from <HOST>$

to catch all characters.

Just sharing this.