Debian. Postfix+Cyrus. Установлен и настроен fail2ban, но периодически в логах появляется лавина сообщений о неудачной авторизации. По идее, после 5-й неудачной попытки IP злоумышленника должен блокироваться, но этого не происходит. За вчера только 15000 неудачных попыток:

--------------------- sasl auth daemon Begin -----
SASL Authentications failed 15011 Time(s)
-----------------------------------------------------------

------------------/var/log/mail.log--------------------
Dec 20 21:57:20 mail saslauthd[7336]: do_auth         : auth failure: [user=samantha] [service=pop] [realm=] [mech=sasldb] [reason=Unknown]
Dec 20 21:57:20 mail cyrus/pop3[2607]: badlogin: quinedgesrv01.quinedge.co.za [196.3.166.193] plaintext samantha SASL(-13): authentication failure: checkpass failed
Dec 20 21:57:25 mail saslauthd[7332]: do_auth         : auth failure: [user=samantha] [service=pop] [realm=] [mech=sasldb] [reason=Unknown]
Dec 20 21:57:25 mail cyrus/pop3[2609]: badlogin: quinedgesrv01.quinedge.co.za [196.3.166.193] plaintext samantha SASL(-13): authentication failure: checkpass failed
Dec 20 21:57:29 mail saslauthd[7336]: do_auth         : auth failure: [user=samantha] [service=pop] [realm=] [mech=sasldb] [reason=Unknown]
--------------------------------------------------------------

----------/etc/fail2ban/jail.conf-----------------------
[sasl]

enabled  = true
port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s,pop
filter   = sasl
logpath  = /var/log/mail.log
maxretry = 5

[cyrus-imap]
enabled  = true
port     = imap2,imap3,imaps,pop3,pop3s,pop
filter   = cyrus-imap
logpath  = /var/log/mail.log
maxretry = 5
-----------------------------------------------------------

--------------/etc/fail2ban/filter.d/sasl.conf----------------------------------------
failregex = : warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: authentication failure$
        : badlogin: [-._\w]+\[<HOST>\] plaintext * SASL(-13): authentication failure: checkpass failed$
        : badlogin: .*\[<HOST>\] plaintext .*SASL\(-13\): authentication failure: checkpass failed$
            : badlogin: .*\[<HOST>\] LOGIN \[SASL\(-13\): authentication failure: checkpass failed\]$
            : badlogin: .*\[<HOST>\] (?:CRAM-MD5|NTLM) \[SASL\(-13\): authentication failure: incorrect (?:digest|NTLM) response\]$
            : badlogin: .*\[<HOST>\] DIGEST-MD5 \[SASL\(-13\): authentication failure: client response doesn't match what we generated\]$
            (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed: \w
            (?i): warning: [-._\w]+\[<HOST>\]: SASL (?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [A-Za-z0-9+/ ]*)?$
-------------------------------------------------------------------------------------------