a few days ago I've set up a VPS, including personal SMTP service using postfix + procmail under Debian / Wheezy.
I am already seeing a LOT of hammering onto the SMTP and other ports. Here's an excerpt:
Jul 31 09:06:25 [myserver] postfix/smtpd: warning: mail.thethirdroom.org[188.8.131.52]: SASL LOGIN authentication failed: authentication failure Jul 31 10:00:02 [myserver] postfix/smtpd: warning: host245-192-static.36-88-b.business.telecomitalia.it[184.108.40.206]: SASL LOGIN authentication failed: authentication failure
There are multiple login attempts per second. Now, I am running sshguard to keep people from bruteforcing there (except if it was a distributed attempt), but postfix is still kind of vulnerable since sshguard does not support that.
Can anyone hint me at how to make this thing more secure?
Thanks a lot!
TL;DR: SMTP server getting hammered, would like to ban IPs after n faulty attempts.