I would like to block some hosts that are brute forcing my SMTP server.
I'm currently using DenyHosts for SSHD and was wondering if I can add the SMTP service too.
It could be possible based on this http://firstname.lastname@example.org/msg00833.html
Currently in my auth.log I get:
Jan 3 17:58:40 servername saslauthd: pam_unix(smtp:auth): check pass; user unknown Jan 3 17:58:40 servername saslauthd: pam_unix(smtp:auth): authentication failure; logname= uid=0 euid=0 tty= ruser= rhost= Jan 3 17:58:42 servername saslauthd: do_auth : auth failure: [user=zzz] [service=smtp] [realm=] [mech=pam] [reason=PAM auth error]
But, from the logs I'm not getting the attacker's host. (I'm using Postfix)
Maybe there is a more "standardized" way of doing this with DenyHosts or is there an alternative?