On 2022-06-08 at 19:58:23 UTC-0400 (Wed, 8 Jun 2022 16:58:23 -0700)
Jim Garrison <[email protected]>
is rumored to have said:
This is a question about Postfix, in relation to fail2ban.
Having recently upgraded to the current Postfix from an ancient
version,
I notice the "disconnect from" log entries now include a summary of
commands received and successfully completed.
I am also seeing lots of password probe attempts that look similar to:
disconnect from unknown[104.148.78.224] ehlo=1 mail=1 rcpt=0/1
quit=1 commands=3/4
Not a password probe. A simple address verification probe, possibly by
someone who doesn't think they're doing anything wrong.
A password probe would have a 'auth=0/1' token.
It occurs to me that this provides a really convenient way to identify
hosts sending password probe attempts by adding a filter that looks
for the regex:
disconnect.*commands=[0123]
This would trigger on any SMTP session that disconnected before
processing a valid RCPT command. With a suitable maxretry setting (say
5) this would stop most probes.
The Postfix question: Is there a reason this is a bad idea, and could
it
cause legitimate MTAs to be banned?
I say "No!" but I may have a more rabid definition of "legitimate" than
you do.
You would block MTAs running Postfix with 'defer_unverified_sender'
enabled. Or CommunigatePro with "SMTP Callback" enabled. Public menaces
who have no idea what problems they can cause.
--
Jim Garrison
[email protected]
--
Bill Cole
[email protected] or [email protected]
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
