Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

a few days ago I've set up a VPS, including personal SMTP service using postfix + procmail under Debian / Wheezy.

I am already seeing a LOT of hammering onto the SMTP and other ports. Here's an excerpt:

Jul 31 09:06:25 [myserver] postfix/smtpd[15372]: warning: mail.thethirdroom.org[81.137.228.117]: SASL LOGIN authentication failed: authentication failure Jul 31 10:00:02 [myserver] postfix/smtpd[20616]: warning: host245-192-static.36-88-b.business.telecomitalia.it[88.36.192.245]: SASL LOGIN authentication failed: authentication failure

There are multiple login attempts per second. Now, I am running sshguard to keep people from bruteforcing there (except if it was a distributed attempt), but postfix is still kind of vulnerable since sshguard does not support that.

Can anyone hint me at how to make this thing more secure?

Thanks a lot!

TL;DR: SMTP server getting hammered, would like to ban IPs after n faulty attempts.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

Check out this tool Fail2Ban, it scans log files for malicious activity and fires off an event. There is bottled event handlers like creating a firewall to reject the offending IP, or you can make your own custom event handlers.

share|improve this answer
add comment

If you are okay with patching and recompiling sshguard, I have written a patch to add Postfix SASL detection. You can get it here:

http://www.djs.to/2013/10/1-postfix-sasl-support-for-sshguard/

This patch is quite simple - it extends sshguard's log file parser to detect the SASL failure messages of the format you describe. Thus failed SASL logins will lead to IP address bans, just like everything else sshguard catches.

share|improve this answer
    
On StackExchange, link-only answers are not that much encouraged. The link is probably ok, but it would improve your answer if you could add a few lines of description, as not everybody will follow the link. –  Bernhard Dec 25 '13 at 9:13
    
Thanks for the advice Bernhard - post updated. I wasn't sure if it was appropriate to post the entire patch here to just a link to it, so went for the latter. –  Darrin Jan 10 at 6:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.