[FR]: exim: detect `SMTP syntax error in`
Author: jas4711Created Aug 30, 2026Updated Aug 31, 2026
Labelsfilter-request
Hi! I got several exim logs that aren't detected by the latest regexps in https://github.com/fail2ban/fail2ban/blob/master/config/filter.d/exim.conf on using fail2ban 1.1.0-8 in Debian 13 with exim 4.98.2-1+deb13u4.
2026-08-30 19:09:12.612 [15057] SMTP connection from [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 (TCP/IP connection count = 1)
2026-08-30 19:09:12.849 [15057] SMTP syntax error in "\026\003\002\001\234\001?\001\230\003\002|9R\245\235\373\201\275j\275\233\2561\327\213?\243P\017;\300S\342?2\315HE\003t\177\257 >\022\337\355[\255k@\3231g\006[UB\030J\255H\3409G\002\240\227W\007\217\340uO\226?\212?\026?3?g\300\236\300\242?\236?9?k\300\237\300\243?\237?E?\276?\210?\304?\232\300\b\300 \300#\300\254\300\256\300+\300" H=59.195.132.66.censys-scanner.com [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 NUL character(s) present (shown as '?')
2026-08-30 19:09:12.849 [15057] SMTP syntax error in "\300$\300\255\300\257\300,\300r\300s\314\251\023\002\023\001\314\024\300\007\300\022\300\023\300'\300/\300\024\300(\3000\300`\300a\300v\300w\314\250\023\005\023\004\023\003\314\023\300\021?" H=59.195.132.66.censys-scanner.com [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 NUL character(s) present (shown as '?')
2026-08-30 19:09:12.850 [15057] SMTP syntax error in "?/?<\300\234\300\240?\234?5?=\300\235\300\241?\235?A?\272?\204?\300?\007?\004?\005\001??\305???\023?\021??\016158.174.10.103?\027???\001?\001\001\377\001?\001??" H=59.195.132.66.censys-scanner.com [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 NUL character(s) present (shown as '?')
2026-08-30 19:09:12.850 [15057] SMTP syntax error in "?" H=59.195.132.66.censys-scanner.com [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 NUL character(s) present (shown as '?')
2026-08-30 19:09:12.850 [15057] SMTP call from 59.195.132.66.censys-scanner.com [66.132.195.59]:54222 I=[158.174.10.103]:25 Ci=15057 dropped: too many syntax or protocol errors (last command was "?", NULL)The last line seems to have some intended match in the filter:
^\s?SMTP call from%(host_info)s dropped: too many (?:(?:nonmail|unrecognized) commands|syntax or protocol errors)but for some reason, it doesn't activate here.
I think the first entries should trigger fail2ban exim earlier, and not wait for the final line.
Thanks, Simon
Source: fail2ban/fail2ban