Home / server / Questions / 225189
Accepted
Javier Novoa C.
Asked: 2011-01-22 07:56:14 +0800 CST

postfix someone is trying to access my server, failing auth access. How to ban it?

  • 772

I have a postfix mail server.

I'm currently receiving a lot of messages telling me that someone with certain IP address is trying to access my server, failing always in the AUTH LOGIN

So... I'm kind of tired of receiving this messages. How can I block this IP address from trying to access my server?

I already tried this (and maybe I tried it badly, please correct me if I'm wrong...):

1)

In main.cf 

smtpd_client_restrictions = check_client_access hash:/etc/postfix/ip_access

And in ip_access file

ip.address.num.ber REJECT

and after that, run

postmap ip_access

And restarting the server, it really doesn't works. I still receive annoying messages...

I receive nothing at logs

2)

In main.cf

smtpd_recipient_restrictions = check_client_access hash:/etc/postfix/ip_access, check_recipient_access hash:/etc/postfix/ip_access
smtpd_sender_restrictions = check_client_access hash:/etc/postfix/ip_access, check_recipient_access hash:/etc/postfix/ip_access

In ip_access file

ip.address.num.ber 550 we do not accept spam

and after that, run again

postmap ip_access

And restarting the server, I get this at logs:

fatal: parameter "smtpd_recipient_restrictions": specify at least one working instance of: check_relay_domains, reject_unauth_destination, reject, defer or defer_if_permit

and also I then stop receiving any messages from any sender, not just this ip address I want to ban...

any idesas? Thanks!

email postfix email-server

5 Answers

  1. Best Answer

    Since it was written by Weitze Venema, it should be compile against tcp wrappers - just add the ip to /etc/hosts.deny

    For automated response to new probes, have a look at fail2ban

    • 5
    • 2

  3. Why not have a look at something like Fail2Ban. It can monitor the log files and block ips based on certain criteria using iptables. This means that Postfix will be left to do what it does best and deliver mail.

    • 2

  4. You can also use a simple iptables rule :

    iptables -I INPUT -s ip_to_block -m tcp -p tcp --dport 25 -j REJECT

    • 1

  5. If you plan on using Fail2Ban, you may be in the same boat I was in: it's hard to find good info on how to permanently ban IP's. This article was a godsend for me! Fail2Ban: Permanent SSH Bans

    • 1