1

I have Postfix, Dovecot and Amavis on my Ubuntu server. Recently, I get every 4 minutes a connection from IP 155.133.82.96, which appears to be Windows XP and maybe has a virus. Anyway, I found the way (after a lot of Googling) to make my Postfix not delay client access checks and I reject that IP. However, it stays around for a while.

I want to find a more radical way to forcibly disconnect the IP when the check has finished and the IP hasn't passed it. How can I do that? (I seek a Postfix solution, not iptables or similar)

0

1 Answer 1

1

This address is part of a network served by a provider in Poland: http://www.tcpiputils.com/browse/ip-address/155.133.82.96

I have also often scans against my MTA coming from that network, mostly/only for SASL login break attempts. What I recommend to keep that stuff away:

  • A solution with Postfix only is not possible as far as I know. But you could use i. e. postgrey/cbpolicyd or a similar daemon or a table for the smtpd_client_restrictions, to handle blacklists. But that's some recurrently manual work …

  • Better use fail2ban: apt-get install fail2ban
    http://www.fail2ban.org/wiki/index.php/Main_Page
    It checks such intrusion attempts very well and bans the IP for 10 minutes (default) in the firewall. The basic rules should usually help enough to throttle such scans.

  • Additionally you can log the activity of fail2ban into a database to count the number of bans of the IPs. Based on this data I block all intruders with more than 25 bans for 7 days. The firewall is updated hourly.
  • Generally a veilling concept: If you're alone using this mail system, think about choosing a non-standard port in Postfix master.conf for your delivery:
smtp inet n  -  n - - smtpd **-o smtpd_sasl_auth_enable=no**
smtps inet n - n - - smtpd **-o smtpd_sasl_auth_enable=no**
**60666 inet n - n - - smtpd -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes**

Usually SASL scans are against ports 25, 465, 567 and if there's no answer, they'll give up. Don't forget to allow additionally this non-standard port in your firewall rules. I'm using this concept for backup MXs with no client traffic.

fail2ban is a very good thing for securing many other services too like sshd or httpd, etc. and the setup is done in some minutes.

4
  • Someone from the mailing list also suggested using postscreen on Postfix, which also works for me.
    – user243975
    Jun 8, 2016 at 16:39
  • Oh, interesting new Postfix feature: link But think about that this works on the application layer only. With f2b you're able to prevent malware or malicious behaviour right before on the network layer. Jun 8, 2016 at 16:56
  • Installed f2b successfully after a bit of fiddling with the configuration files.
    – user243975
    Jun 8, 2016 at 17:00
  • 1
    Have a look to /etc/fail2ban/jail.d/defaults-debian.conf: '[postfix] enabled = true [dovecot] enabled = true' should be enough. Jun 8, 2016 at 17:14

You must log in to answer this question.