I recently setup my first postfix server and am loving life. :)

But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that there was one IP that kept hammering the SASL login, and failing obviously. I banned the IP with ufw, but that's not a very efficient solution. What I'm left wondering is why this sort of behavior is allowed by default, and what I can do to mitigate against these types of attacks.

  1. Why was this IP allowed to repeatedly fail to autheticate, and not blacklisted? What do I change to make that happen?

  2. Is there some way I can setup notifications or alerts to this sort of failure pattern if I can't automatically handle the situation, and need to manually block the IP with ufw?

  3. Is there any real harm in just letting these poop birds try to break into my system willy nilly? Should I be worried about this?

  • 2
    Look up fail2ban. It's designed for this. – Sven Jul 13 at 11:39

Regarding point 1 For Debian based systems you could use fail2ban. You can install it with sudo apt install fail2ban (or running it as root user, when you don't have sudo rights.)

If you are running a limited VM you can try denyhosts

To install this, you have to sudo apt install denyhosts

Both do the same, prevent intruders to bruteforce your Server, however fail2ban has the ability to check on a periode of time to prevent the same IP checking your server again

For point 2 You can setup Action on fail2ban and denyhosts to get notifications about the executed Actions.

And regarding point 3

If they gain access, they either make this device to a Zombie or Spam Sender or both, so dont use a generic password. My Servers are also checked daily from random IPs.

  • Regarding point 3: To stop the attackers, and harden your server, check out the CIS Benchmarks for your Server OS and apply the recommended settings. – mhr Aug 5 at 9:07

ConfigServer Security & Firewall (CSF + LFD) does the job perfectly.

It ships with the Login Failure Daemon (lfd), which acts as a quasi real-time log parser. What it does is generate a rule on the fly to block the offending IP address in your firewall (iptables) after a predetermined number of failed attempts, and it can also send an alert by E-mail. A typical server exposed on the Internet is going to be probed by hundreds, thousands of attackers on a daily basis. So, expect to receive a lot of notifications.

Note that the block is not permanent, the IP address will be unbanned after a period of time.

LFD covers most common services such as SSH, SMTP, POP etc out of the box, but you can add custom rules if needed (some understanding of regular expressions may be required since LFD does log parsing).

Even if your server is well protected, it doesn't have to allow that hammering to take place - it's still a lot of wasted resources. Better to block them right away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.