On 02/24/2014 09:37 PM, Eric Shubert wrote:
> On 02/24/2014 09:16 PM, cj yother wrote:
>> I ban no host name, no rDNS and failed login
>> attempts after 3 tries for 24 hours. It's made a measurable difference
>> on the load on the server.
>
> What constitutes "no host name"? (I think I know what no rDNS is).
This is the entry I use for no host name. This is where it's taken some
of the load off the server. It bans them when they try 3 or more time
from the same IP with no reverse hostname. Postfix rejects the first
three and Fail2ban takes it from there.
failregex = reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1 Client host
rejected: cannot find your reverse hostname
>
> Failed login attempts are an entirely different animal, at least in
> the context of this thread. Can you separate this aspect from the
> other 2 with regards to measurable difference?
I use this Fail2ban entry for failed login attempts. It bans them after
3 attempts from the same IP.
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [
A-Za-z0-9+/]*={0,2})?\s*$
>
> You say measurable difference on the load. Can you share these
> measures? (Be specific. It's not that I don't trust you of course. ;) )
I only measure it comparing the Logwatch SASL attempts before and after
implementing the Fail2ban. Sorry about the lack of detail.
>
> Also, does your postfix configuration reject rDNS (or "no host name")
> outright, or are these messages scanned? If they're not rejected
> outright (without being scanned, or even accepted), I'm afraid that
> your "measurable difference" would not be applicable when spamdyke is
> used. spamdyke rejects these messages without even receiving them.
Postfix processes them and rejects them like this:
postfix/smtpd[15414]: NOQUEUE: reject: RCPT from unknown[64.206.88.186]:
450 4.7.1 Client host rejected: cannot find your reverse hostname,
Not sure if that's pre processing it or not. NOQUEUE would tell me it's
not making it to the QUE. If that's not reading too much into it.
>
> What say you?
> Thanks.
>
I hope this helps.
--
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
