|
From: Kevin Z. <kev...@gm...> - 2016-02-02 16:13:24
|
On 02/02/2016 06:11, Christophe Meessen wrote: > I currently have some people trying to authenticate throuqh the port 25. > I suppose they try out default passwords. > I get up to 100 attempts in a few tens of seconds and they retry every > hour. Fai2ban fails to detect and block them. > There are also the ports 465 (SMTPS) and 587 with SASL authentication > which may fail. I currently don't have any failed connection attempts on > these ports, but this is just a matter of time. > > I'm ready to switch from fail2ban to sshguard, but your web site doesn't > report a support of Postfix. This is a bit surprizing since many people > use Postfix. So my question is if sshguard supports Postfix protection. At the moment, tentatively. SSHGuard only recognizes this SASL authentication failure as an attack: warning: unknown[1.2.3.4]: SASL LOGIN authentication failed: If this is the one you're seeing SSHGuard should work fine. Just make sure to feed it the appropriate log files. Best, Kevin -- Kevin Zheng kev...@gm... | ke...@kd... | PGP: 0xC22E1090 |