From: Mauricio T. <rau...@gm...> - 2014-04-24 15:20:33
|
On Thu, Apr 24, 2014 at 11:09 AM, Jacek Zaleski <sir...@gm...> wrote: > > Anynone have idea how make filtr for citadel mta smtp >> >> First you figure out what you do you want to look for. The idea is to look for a pattern that repeats very quickly, indicating that someone is repetitively hammering (bruteforce) your server. If you look at your own logs, >> >> Apr 24 16:46:48 at citserver[6934]: Session (SMTP-MTA) started from vm25-9.hacker.com (66.66.66.66). >> Apr 24 16:46:48 at citserver[6934]: SMTP server: EHLO vm25-9.hosteur.com >> Apr 24 16:46:48 at citserver[6934]: SMTP server: MAIL FROM:<> SIZE=6697 >> Apr 24 16:46:48 at citserver[6934]: SMTP server: RCPT TO:<ad...@xx...l> >> Apr 24 16:46:48 at citserver[6934]: Directory key is <ad...@xx...> >> Apr 24 16:46:48 at citserver[6934]: CC[494]Changed to <admin> >> Apr 24 16:46:48 at citserver[6934]: SMTP server: QUIT >> Apr 24 16:46:48 at citserver[6934]: Performing SMTP cleanup hook >> Apr 24 16:46:48 at citserver[6934]: Closing socket 38 >> Apr 24 16:46:48 at citserver[6934]: Context: [494]SRV[SMTP-MTA] Session ended it makes me think vm25-9.hacker.com had not problems connecting to your smtp port. Do you do any smtp auth? If so, that should look in your logs as some kind of auth failed message, kinda of what you would see with ssh login attempts. And that would be something to look for. > > [ > GG : 3857388 > > Before printing this document , think about the environment > > > ] > > ------------------------------------------------------------------------------ > Start Your Social Network Today - Download eXo Platform > Build your Enterprise Intranet with eXo Platform Software > Java Based Open Source Intranet - Social, Extensible, Cloud Ready > Get Started Now And Turn Your Intranet Into A Collaboration Platform > http://p.sf.net/sfu/ExoPlatform > _______________________________________________ > Fail2ban-users mailing list > Fai...@li... > https://lists.sourceforge.net/lists/listinfo/fail2ban-users > |