anchor.diff:  [courierauth]
   
   enabled  = false
  -port	 = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
  +port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
   filter   = courierlogin
  -logpath  = /var/log/maillog
  +logpath  = /var/log/mail.log
   
   
   [sasl]
   
   enabled  = false
  -port	 = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
  +port     = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
   filter   = sasl
  -logpath  = /var/log/maillog
  +# You might consider monitoring /var/log/mail.warn instead if you are
  +# running postfix since it would provide the same log lines at the
  +# "warn" level but overall at the smaller filesize.
  +logpath  = /var/log/mail.log
  +
  +[dovecot]
  +
  +enabled = false
  +port    = smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s
  +filter  = dovecot
  +logpath = /var/log/mail.log
  +
  +# DNS Servers
  +
  +
  +# These jails block attacks against named (bind9). By default, logging is off
  +# with bind9 installation. You will need something like this:
  +#
  +# logging {
  +#     channel security_file {
  +#         file "/var/log/named/security.log" versions 3 size 30m;
  +#         severity dynamic;
  +#         print-time yes;
  +#     };
  +#     category security {
  +#         security_file;
  +#     };
  +# };
  +#
  +# in your named.conf to provide proper logging
  +
  +# !!! WARNING !!!
  +#   Since UDP is connection-less protocol, spoofing of IP and imitation
  +#   of illegal actions is way too simple.  Thus enabling of this filter
  +#   might provide an easy way for implementing a DoS against a chosen
  +#   victim. See
  +#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html
  +#   Please DO NOT USE this jail unless you know what you are doing.
  +#[named-refused-udp]
  +#
  +#enabled  = false
  +#port     = domain,953
  +#protocol = udp
  +#filter   = named-refused
  +#logpath  = /var/log/named/security.log
  +
  +[named-refused-tcp]
  +
  +enabled  = false
  +port     = domain,953
  +protocol = tcp
  +filter   = named-refused
  +logpath  = /var/log/named/security.log
  +
  
positive.code: [proftpd]
  
  enabled  = false
  port	 = ftp,ftp-data,ftps,ftps-data
  filter   = proftpd
  logpath  = /var/log/proftpd/proftpd.log
  maxretry = 6
  
  
  [wuftpd]
  
  enabled  = false
  port	 = ftp,ftp-data,ftps,ftps-data
  filter   = wuftpd
  logpath  = /var/log/auth.log
  maxretry = 6
  
negative.code: [vsftpd]
  
  enabled  = false
  port     = ftp,ftp-data,ftps,ftps-data
  filter   = vsftpd
  logpath  = /var/log/vsftpd.log
  # or overwrite it in jails.local to be
  