3

I have a Fail2Ban jail that monitors failed SASL authentications to my Postfix SMTP server. When this occurs, /var/log/mail.log contains these three lines:

postfix/smtpd[32591]: connect from unknown[x.x.x.x]
postfix/smtpd[32591]: warning: unknown[x.x.x.x]: SASL LOGIN authentication failed: authentication failure
postfix/smtpd[32591]: disconnect from unknown[x.x.x.x]

And Fail2Ban filters the warning line: if it is found, the IP is considered for banning.

Recently, I changed Postfix so that AUTH is available over TLS only (using option smtpd_tls_auth_only). A consequence is that the warning line is not generated anymore when someone tries to authenticate without TLS:

postfix/smtpd[22469]: connect from unknown[x.x.x.x]
postfix/smtpd[22469]: disconnect from unknown[x.x.x.x]

Which means Fail2Ban is not able to monitor all SASL authentication attempts anymore. How can I do that?

A solution I came up with is to make SMTP more verbose (appending -v to smtpd in /etc/postfix/master.cf) and parse appropriate lines, but my problem with this is that the -v option makes the logs too verbose:

postfix/smtpd[23185]: connect from unknown[x.x.x.x]
postfix/smtpd[23185]: match_list_match: x.x.x.x: no match
postfix/smtpd[23185]: match_list_match: x.x.x.x: no match
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? 127.0.0.0/8
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? [::ffff:127.0.0.0]/104
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? [::1]/128
postfix/smtpd[23185]: match_list_match: x.x.x.x: no match
postfix/smtpd[23185]: send attr ident = smtp:x.x.x.x
postfix/smtpd[23185]: > unknown[x.x.x.x]: 220 example.org ESMTP Postfix (Debian/GNU)
postfix/smtpd[23185]: < unknown[x.x.x.x]: EHLO User
postfix/smtpd[23185]: match_list_match: x.x.x.x: no match
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-example.org
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-PIPELINING
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-SIZE 10240000
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-VRFY
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-ETRN
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-STARTTLS
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-ENHANCEDSTATUSCODES
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250-8BITMIME
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250 DSN
postfix/smtpd[23185]: < unknown[x.x.x.x]: RSET
postfix/smtpd[23185]: > unknown[x.x.x.x]: 250 2.0.0 Ok
postfix/smtpd[23185]: < unknown[x.x.x.x]: AUTH LOGIN
postfix/smtpd[23185]: > unknown[x.x.x.x]: 503 5.5.1 Error: authentication not enabled
postfix/smtpd[23185]: < unknown[x.x.x.x]: QUIT
postfix/smtpd[23185]: > unknown[x.x.x.x]: 221 2.0.0 Bye
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? 127.0.0.0/8
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? [::ffff:127.0.0.0]/104
postfix/smtpd[23185]: match_hostaddr: x.x.x.x ~? [::1]/128
postfix/smtpd[23185]: match_list_match: x.x.x.x: no match
postfix/smtpd[23185]: send attr ident = smtp:x.x.x.x
postfix/smtpd[23185]: disconnect from unknown[x.x.x.x]

A priori, I only need to filter the authentication not enabled line. Is it possible to make the SMTP service to report auth requests without adding the whole verbose messages? Ideally my mail.log file would only contain:

postfix/smtpd[32591]: connect from unknown[x.x.x.x]
postfix/smtpd[32591]: warning: unknown[x.x.x.x]: authentication not enabled
postfix/smtpd[32591]: disconnect from unknown[x.x.x.x]

Is this something possible? If yes, how? Thanks,

  • If the clients are using EHLO they should be aware that AUTH isn't available without TLS. They may no longer be trying. I would expect a different messages. Try using telnet to see what your server is saying and what error it generates for an AUTH request without TLS. – BillThor Jan 3 '16 at 16:08
  • @BillThor What do you mean by "They may no longer be trying"? I tried using Telnet, and I have a behavior similar to the output in the verbose log. – piwi Jan 3 '16 at 20:01
  • 1
    With auth disabled they shouldn't get anywhere near a SASL login without TLS. The 503 is a server error indicating LOGIN is not enabled. They won't be able to attempt a login. You may want to filter on connect from unknown as this is an indicator that the connection most likely did not come from a legitimate email server. – BillThor Jan 3 '16 at 21:24
  • Thanks @BillThor I did as you suggested (filtering on connect from unknown) and I can detect the AUTH attempt as I wanted. However, do you have an idea why even with an IP banned by iptables, Postfix reports AUTH attempt anyway? Thanks again. – piwi Jan 7 '16 at 20:22
  • This Question is a perfect explanation for my problem. Had a lot of "attackes" that know they could make an AUTH because of the EHLO answer, but make a AUTH request and after that they - clean QUIT. It would be perfect to have an solution to get any info into the logfile, to block them with a fail2ban rule. – sebkrueger Sep 14 '18 at 11:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.