On 02/24/2014 11:06 PM, cj yother wrote:
On 02/24/2014 09:37 PM, Eric Shubert wrote:
On 02/24/2014 09:16 PM, cj yother wrote:
I ban no host name, no rDNS and failed login
attempts after 3 tries for 24 hours. It's made a measurable difference
on the load on the server.
What constitutes "no host name"? (I think I know what no rDNS is).
This is the entry I use for no host name. This is where it's taken some
of the load off the server. It bans them when they try 3 or more time
from the same IP with no reverse hostname. Postfix rejects the first
three and Fail2ban takes it from there.
failregex = reject: RCPT from (.*)\[<HOST>\]: 450 4.7.1 Client host
rejected: cannot find your reverse hostname
So this is the same as spamdyke's DENIED_RDNS_RESOLVE.
Failed login attempts are an entirely different animal, at least in
the context of this thread. Can you separate this aspect from the
other 2 with regards to measurable difference?
I use this Fail2ban entry for failed login attempts. It bans them after
3 attempts from the same IP.
failregex = (?i): warning: [-._\w]+\[<HOST>\]: SASL
(?:LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed(: [
A-Za-z0-9+/]*={0,2})?\s*$
You say measurable difference on the load. Can you share these
measures? (Be specific. It's not that I don't trust you of course. ;) )
I only measure it comparing the Logwatch SASL attempts before and after
implementing the Fail2ban. Sorry about the lack of detail.
No doubt the log messages will drop. That's not a very good measure of
load though. Plus, there are possibly differences in efficiency between
postfix's implementation of these features and spamdyke's
implementation. Even if there is a measurable drop in the load (which
you've yet to demonstrate), the question should be, is the drop
significant. IOW, if your host isn't suffering from performance at all
(and I doubt that many are), what's a little performance improvement worth?
Also, does your postfix configuration reject rDNS (or "no host name")
outright, or are these messages scanned? If they're not rejected
outright (without being scanned, or even accepted), I'm afraid that
your "measurable difference" would not be applicable when spamdyke is
used. spamdyke rejects these messages without even receiving them.
Postfix processes them and rejects them like this:
postfix/smtpd[15414]: NOQUEUE: reject: RCPT from unknown[64.206.88.186]:
450 4.7.1 Client host rejected: cannot find your reverse hostname,
Not sure if that's pre processing it or not. NOQUEUE would tell me it's
not making it to the QUE. If that's not reading too much into it.
I expect that's true. I wonder though if postfix accepts transmission of
the message in this case (spamdyke does not).
Thanks CJ.
--
-Eric 'shubes'
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
