"postfix/smtpd[28164]: warning: unknown[]: SASL PLAIN authentication failed: authentication failure"

Normally I'd use fail2ban however it seems that under the openvz container fail2ban and some segments of firewalld do not work properly. Does fine on my dedicated but not the vps setups. I long ago moved SSH off of non standard ports so the attempts are solely aimed at the mail server.

So I guess the question is:

Is there a way to get fail2ban to work under firewalld/Cento 7/OpenVZ vps container or

Is there an alternate way to either stop or throttle these connections.

Seems most of the solutions point towards fail2ban I have had a hard time finding something else that can at least make it difficult to hammer the server such as some throttling mechanisms in postfix itself.

Looking to see what others may suggest.


Sounds like knockd is a viable solution for your problem. Think of it like a combination lock using ports.

man page: https://linux.die.net/man/1/knockd

deprecated but useful tutorial: https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu

another deprecated article that outlines using iptables only: https://www.digitalocean.com/community/tutorials/how-to-configure-port-knocking-using-only-iptables-on-an-ubuntu-vps

| improve this answer | |
  • How would knockd work for OPs mailserver ? – pLumo Jun 24 '19 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.