Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 23:09, Wietse Venema wrote: > This is not needed. Postfix 3.0 and later log the AUTH failure AND > the client IP address together: > > postfix/smtpd[xxx]: disconnect from unknown[x.x.x.x] auth=0/1 commands=0/1 > > This is logged even when AUTH is disabled (as it should be on port

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 23:26, Jaroslaw Rafa wrote: > Well, maybe I'm using quite old versions of Postfix and Dovecot, but with > default logging setup on Debian plus "auth_verbose=yes" in Dovecot config I > get in /var/log/mail.log lines like: Well, as I said, we're using postfix + saslauthd, and not

Re: Best current practice to analyze brute force login attempts?

2021-07-31 Thread Hadmut Danisch
On 30.07.21 22:24, Aleksei Shpakovskii wrote: > Hi, > > To answer the original Hadmut question: I believe that in order to log > both postfix and saslauthd to the same file, you should configure both > of them to use same logging backend (syslog), and configure that > backend to save their logs

Best current practice to analyze brute force login attempts?

2021-07-30 Thread Hadmut Danisch
Hi, we are experiencing permanent high traffic from numerous sites trying to smtp auth to our postfix node, obviously trying to brute force password dictionaries against mail address lists probably taken from spam lists (including lots of oder message ids with the same syntax as mail addresses).

Re: batching all mails to one or more domains to a non-permanently-powered machine with dynamic addresses

2021-01-29 Thread Hadmut Danisch
On 29.01.21 09:54, Daniele Nicolodi wrote: > I don't know how complex it would to setup a solution based on it, but > NNCP http://www.nncpgo.org/ is a replacement for UUCP with modern > cryptography and design. At a first glance, this looks good and like what I was looking for. :-) thanks!

Re: batching all mails to one or more domains to a non-permanently-powered machine with dynamic addresses

2021-01-29 Thread Hadmut Danisch
On 29.01.21 14:40, Jaroslaw Rafa wrote: > Can't fetchmail do that? It seems it pretty advanced in recent versions... It seems to be able to, and there's others (like getmail). But: This is the client/pull side. I need the server side. regards Hadmut

Re: batching all mails to one or more domains to a non-permanently-powered machine with dynamic addresses

2021-01-29 Thread Hadmut Danisch
On 29.01.21 12:39, Matus UHLAR - fantomas wrote: > I'd recommend considering domain mailboxes. Is there any better way to do this than local(8) and X-Original-To: ? As far as I know, local(8) cannot cope with mails to multiple recipients. E.g. a mail to both  a...@somedomain.de  and

Re: batching all mails to one or more domains to a non-permanently-powered machine with dynamic addresses

2021-01-29 Thread Hadmut Danisch
On 29.01.21 09:41, Arjen Van Drie wrote: > ETRN ? That's an old SMTP command, used from nodes that are not continuously online. Imagine two SMTP relays, A and B, where A is configured to forward some mails (e.g. for a domain) to B. But if B is not always online, e.g. because of a dial in

batching all mails to one or more domains to a non-permanently-powered machine with dynamic addresses

2021-01-28 Thread Hadmut Danisch
Hi, I'm looking for a new solution to solve a problem that was formerly properly solved with UUCP over TLS for the last 15 years, but since UUCP is really stone aged and not supported anymore, I'm looking for a solution and didn't find one. Given Problem: A server nachine with postfix running

Re: Blocking TLD (one component access list queries)

2017-12-14 Thread Hadmut Danisch
On 12.12.2017 09:00, Anvar Kuchkartaev wrote: > If IP address and domain names continuously changes they are probably fake > domain names and emails sent by randomly exploited servers. No, not that way. That's what I used to see 5 or 10 years ago as the main source of spam. Nowadays I find

Blocking TLD (one component access list queries)

2017-12-10 Thread Hadmut Danisch
Hi, I'm getting tons of spam with mail senders or helo names from TLDs like .date, e.g. Received: from koan-shf.date (unknown [78.129.179.127]) by... where the domain names (here: koan-shf.date) rapidly change and are obviously randomly generated. IP addresses also change daily. I'd

TLS Client certificate expiry?

2010-05-15 Thread Hadmut Danisch
Hi, just a configuration/security question: I am running a postfix server which allows relaying and using particular sender domains for some people, but not for the public. The authorised users have to authnticate either with SASL or TLS client certificates. Since the server works also as a

Re: TLS Client certificate expiry?

2010-05-15 Thread Hadmut Danisch
..btw., using postfix 2.6.5-3 (debian)