Re: blocking 465 connections to mail server for specific IP address without using fail2ban

From	Andrew McGlashan <andrew.mcglashan@affinityvision.com.au>
Newsgroups	linux.debian.user
Subject	Re: blocking 465 connections to mail server for specific IP address without using fail2ban
Date	2019-06-23 00:10 +0200
Message-ID	<ybWmR-79K-1@gated-at.bofh.it> (permalink)
References	<ybIDf-7eg-3@gated-at.bofh.it> <ybJIZ-7Qn-5@gated-at.bofh.it> <ybP22-2Hp-3@gated-at.bofh.it> <ybPln-2Nv-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

The script needs more work.... it is not exim4-exploiters, it is for
repeated failed logins.

As it is now, it will treat any single failure as one to ban and that
is only going to cause trouble.  Although users should be logged in
normally and will likely have passwords saved in their clients so when
they try to send emails, they can only do so as authenticated and they
will be properly authenticated every time unless they are manually
logging in to simple do an smtp auth send.... so it might not be so
bad, I may just need to rename the ipsets, but I'll think about it
some more.

Anyway, it's a good start.

Cheers
A.
-----BEGIN PGP SIGNATURE-----

iHUEAREIAB0WIQTJAoMHtC6YydLfjUOoFmvLt+/i+wUCXQ6lgwAKCRCoFmvLt+/i
+0d1AP9tNbfrC62Ts/dWoDFaGH18qa05IvvUyiZnIb82zZtN4gEAoKNToikHpnaW
DQuxWFxLjruS3NWgMIKv/H3xiXZsqRE=
=JJ18
-----END PGP SIGNATURE-----

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

blocking 465 connections to mail server for specific IP address  without using fail2ban Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-22 09:30 +0200
  Re: blocking 465 connections to mail server for specific IP address  without using fail2ban john doe <johndoe65534@mail.com> - 2019-06-22 10:40 +0200
    Re: blocking 465 connections to mail server for specific IP address  without using fail2ban Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-22 16:20 +0200
      Re: blocking 465 connections to mail server for specific IP address  without using fail2ban Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-22 16:40 +0200
        Re: blocking 465 connections to mail server for specific IP address  without using fail2ban Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2019-06-23 00:10 +0200

csiph-web