Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a postfix mail server.

I'm currently receiving a lot of messages telling me that someone with certain IP address is trying to access my server, failing always in the AUTH LOGIN

So... I'm kind of tired of receiving this messages. How can I block this IP address from trying to access my server?

I already tried this (and maybe I tried it badly, please correct me if I'm wrong...):

1)

In main.cf

smtpd_client_restrictions = check_client_access hash:/etc/postfix/ip_access

And in ip_access file

ip.address.num.ber REJECT

and after that, run

postmap ip_access

And restarting the server, it really doesn't works. I still receive annoying messages...

I receive nothing at logs

2)

In main.cf

smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/ip_access, check_recipient_access hash:/etc/postfix/ip_access
smtpd_sender_restrictions = check_client_access hash:/etc/postfix/ip_access, check_recipient_access hash:/etc/postfix/ip_access

In ip_access file

ip.address.num.ber 550 we do not accept spam

and after that, run again

postmap ip_access

And restarting the server, I get this at logs:

fatal: parameter "smtpd_recipient_restrictions": specify at least one working instance of: check_relay_domains, reject_unauth_destination, reject, defer or defer_if_permit

and also I then stop receiving any messages from any sender, not just this ip address I want to ban...

any idesas? Thanks!

share|improve this question
    
Why not block it with iptables or at your firewall? –  Bart Silverstrim Jan 21 '11 at 16:00

5 Answers 5

up vote 4 down vote accepted

Since it was written by Weitze Venema, it should be compile against tcp wrappers - just add the ip to /etc/hosts.deny

For automated response to new probes, have a look at fail2ban

share|improve this answer
    
Thanks, that done it... –  Javier Novoa C. Jan 21 '11 at 17:01

Fail2Ban

share|improve this answer
    
I'll give it a try, thanks! –  Javier Novoa C. Jan 21 '11 at 16:20

Why not have a look at something like Fail2Ban. It can monitor the log files and block ips based on certain criteria using iptables. This means that Postfix will be left to do what it does best and deliver mail.

share|improve this answer
    
I'll give it a try, thanks! –  Javier Novoa C. Jan 21 '11 at 16:19

You can also use a simple iptables rule :

iptables -I INPUT -s ip_to_block -m tcp -p tcp --dport 25 -j REJECT

share|improve this answer

If you plan on using Fail2Ban, you may be in the same boat I was in: it's hard to find good info on how to permanently ban IP's. This article was a godsend for me! Fail2Ban: Permanent SSH Bans

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.