Re: [SSHGuard-users] sshguard sniffing postifx---no odor detected

[Kevin Z. <kev...@gm...>]

On 05/20/2016 19:40, li...@la... wrote:
> I set up a simple script using swaks to hit my email server with 100
> messages to relay. Since I don't have an open relay, these actions get
> flagged by postfix. Eventually the connection got dropped by postfix
> anvil, the rate limiter. Best I can tell postfix locks me out for 600
> seconds.
> http://www.postfix.org/anvil.8.html

It sounds like anvil(8) does the right thing.

> In any event, sshguard didn't block me. I grepped all the auth.logs for
> the offending IP. (I would have done more email testing but the Peet's
> wifi is on a dynamic blocking list!)

SSHGuard doesn't know about RCPT TO rejects (yet). We could teach it to.
Ultimately, it looks like anvil does what you want, so perhaps just add
a rule to block the offender using the firewall when anvil starts to
rate-limit? This might potentially be a better option since we won't
need attack signatures for every error message that can be generated by
a spammer.

Thoughts?

Best,
Kevin

-- 
Kevin Zheng
kev...@gm... | ke...@be... | PGP: 0xC22E1090