a few days ago I've set up a VPS, including personal SMTP service using postfix + procmail under Debian / Wheezy.

I am already seeing a LOT of hammering onto the SMTP and other ports. Here's an excerpt:

Jul 31 09:06:25 [myserver] postfix/smtpd[15372]: warning: mail.thethirdroom.org[]: SASL LOGIN authentication failed: authentication failure Jul 31 10:00:02 [myserver] postfix/smtpd[20616]: warning: host245-192-static.36-88-b.business.telecomitalia.it[]: SASL LOGIN authentication failed: authentication failure

There are multiple login attempts per second. Now, I am running sshguard to keep people from bruteforcing there (except if it was a distributed attempt), but postfix is still kind of vulnerable since sshguard does not support that.

Can anyone hint me at how to make this thing more secure?

Thanks a lot!

TL;DR: SMTP server getting hammered, would like to ban IPs after n faulty attempts.


Check out this tool Fail2Ban, it scans log files for malicious activity and fires off an event. There is bottled event handlers like creating a firewall to reject the offending IP, or you can make your own custom event handlers.

| improve this answer | |
  • Fail2ban just saved my life. I never realised it can also stop brute force attacks on SMTP and POP3. – Eugene van der Merwe Mar 5 '19 at 14:07

If you are okay with patching and recompiling sshguard, I have written a patch to add Postfix SASL detection. You can get it here:


This patch is quite simple - it extends sshguard's log file parser to detect the SASL failure messages of the format you describe. Thus failed SASL logins will lead to IP address bans, just like everything else sshguard catches.

| improve this answer | |
  • On StackExchange, link-only answers are not that much encouraged. The link is probably ok, but it would improve your answer if you could add a few lines of description, as not everybody will follow the link. – Bernhard Dec 25 '13 at 9:13
  • Thanks for the advice Bernhard - post updated. I wasn't sure if it was appropriate to post the entire patch here to just a link to it, so went for the latter. – Darrin Jan 10 '14 at 6:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.