I recently setup my first postfix server and am loving life. :)
But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that there was one IP that kept hammering the SASL login, and failing obviously. I banned the IP with ufw, but that's not a very efficient solution. What I'm left wondering is why this sort of behavior is allowed by default, and what I can do to mitigate against these types of attacks.
Why was this IP allowed to repeatedly fail to autheticate, and not blacklisted? What do I change to make that happen?
Is there some way I can setup notifications or alerts to this sort of failure pattern if I can't automatically handle the situation, and need to manually block the IP with ufw?
Is there any real harm in just letting these poop birds try to break into my system willy nilly? Should I be worried about this?