This address is part of a network served by a provider in Poland:
http://www.tcpiputils.com/browse/ip-address/155.133.82.96
I have also often scans against my MTA coming from that network, mostly/only for SASL login break attempts. What I recommend to keep that stuff away:
A solution with Postfix only is not possible as far as I know. But you could use i. e. postgrey/cbpolicyd or a similar daemon or a table for the smtpd_client_restrictions, to handle blacklists. But that's some recurrently manual work …
Better use fail2ban: apt-get install fail2ban
http://www.fail2ban.org/wiki/index.php/Main_Page
It checks such intrusion attempts very well and bans the IP for 10 minutes (default) in the firewall. The basic rules should usually help enough to throttle such scans.
- Additionally you can log the activity of fail2ban into a database to count the number of bans of the IPs. Based on this data I block all intruders with more than 25 bans for 7 days. The firewall is updated hourly.
- Generally a veilling concept: If you're alone using this mail system, think about choosing a non-standard port in Postfix master.conf for your delivery:
smtp inet n - n - - smtpd **-o smtpd_sasl_auth_enable=no**
smtps inet n - n - - smtpd **-o smtpd_sasl_auth_enable=no**
**60666 inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes**
Usually SASL scans are against ports 25, 465, 567 and if there's no answer, they'll give up. Don't forget to allow additionally this non-standard port in your firewall rules. I'm using this concept for backup MXs with no client traffic.
fail2ban is a very good thing for securing many other services too like sshd or httpd, etc. and the setup is done in some minutes.