if possible do it and update the server
I did that but nothing is help.
However, after done some researches, I guess either fail2ban or csf might help to solve this issue.
For CSF, need to set the custom regex on CSF but I need someone helping me on the custom regex for detecting the patterns at below.
Apr 29 21:50:20 server postfix/smtpd[20416]: NOQUEUE: reject: RCPT from LStLambert-657-1-68-104.w80-13.abo.wanadoo.fr[80.13.44.104]: 454 4.7.1 Service unavailable; Client host [80.13.44.104] blocked using dnsbl.sorbs.net; Dynamic IP Addresses See: http://www.sorbs.net/lookup.shtml?80.13.44.104; from=<> to=<Marrero_Cecil@domain.com> proto=ESMTP helo=<EX16.SUR-INTERNET.COM>
Apr 29 21:50:26 server postfix/smtpd[20419]: NOQUEUE: reject: RCPT from exchange.swissfilms.ch[213.200.251.180]: 450 4.1.1 <numbers_danial@domain.com>: Recipient address rejected: User unknown in virtual mailbox table; from=<> to=<numbers_danial@domain.com> proto=ESMTP helo=<exchange.swissfilms.ch>
I had this regex set in the file /etc/csf/regex.custom.pm, but it did not work.
if (($globlogs{CUSTOM2_LOG}{$lgfile}) and ($line =~ /^\S+\s+\S+\s+(\S+)\s+reject: RCPT from \S+: 450 4.1.1/)) {
return ("SMTP spam attack",$1,"SMTP","1","1");
}
As for fail2ban, I enabled the [postfix-tcpwrapper] at /etc/fail2ban/jail.conf. And, in file /etc/fail2ban/filter.d/postfix.conf, I had the regex pattern set but nothing seems to work as nothing appended into file /etc/hosts.deny.
[postfix-tcpwrapper]
enabled = true
filter = postfix
action = hostsdeny[file=/etc/hosts.deny]
logpath = /var/log/postfix.log
bantime = 604800
ignoreip = 127.0.0.1/8
findtime = 300
maxretry = 1
failregex = reject: RCPT from .*\[<HOST>\]: 450 4.1.1
.*postfix/\smtpd.*reject: RCPT from .*\[<HOST>\]: 450 4.1.1
Anyone can advise me on the regex pattern? Thanks.
Topic: Mail spamming or attack? (Read 16730 times)
