On 15 Nov 2019, at 03:21, Allen Coates <[email protected]> wrote: > Disabling auth does not stop them from trying; I scan my logs for the string > "auth=0/1", and add the offending IP address to a blacklist - a do-it-yourself > fail2ban.
Seems like a good idea. Something like this? pfctl -t badguys -T add $(grep "auth=0/1" /var/log/mail.log | egrep -o "\[[^]]*\.[^]]*\]" | tr -d '[]’) -- "Real stupidity beats artificial intelligence every time.”
