email - 后缀/提交/smtpd : How to blacklist IP addresses with too many failed login attempts using fail2ban or by any other means

Question

关闭。这个问题不符合Stack Overflow guidelines .它目前不接受答案。












我们不允许在 Stack Overflow 上提出有关专业服务器或网络相关基础设施管理的问题。您可以编辑问题，使其成为 on-topic对于堆栈溢出。


7 天前关闭。







Improve this question




我在 Raspberry Pi 上使用 Ubuntu Server 20.04 运行 LEMP 网络/电子邮件服务器。我已经成功地在它上面设置了一个电子邮件服务器 a lengthy guide from linuxbabe.com .正如教程所指示的，我还安装了 clam-av、amavis、postfix 和 dovecot。在本教程之外，我还安装了 fail2ban。现在我正在尝试微调和保护一些东西。当我运行命令 cat /var/log/mail.log ，我得到很多这样的重复日志行:

Jun 16 20:36:25 mail postfix/smtpd[266714]: Anonymous TLS connection established from green.census.shodan.io[185.142.236.36]: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256
Jun 16 20:36:25 mail postfix/smtpd[266714]: lost connection after STARTTLS from green.census.shodan.io[185.142.236.36]
Jun 16 20:36:25 mail postfix/smtpd[266714]: disconnect from green.census.shodan.io[185.142.236.36] ehlo=1 starttls=1 commands=2
Jun 16 20:36:26 mail postfix/smtpd[266707]: connect from green.census.shodan.io[185.142.236.36]
Jun 16 20:36:26 mail postfix/smtpd[266707]: lost connection after UNKNOWN from green.census.shodan.io[185.142.236.36]
Jun 16 20:36:26 mail postfix/smtpd[266707]: disconnect from green.census.shodan.io[185.142.236.36] unknown=0/1 commands=0/1

像这样:

Jun 16 13:42:14 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:14 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]
Jun 16 13:42:15 mail postfix/submission/smtpd[228650]: lost connection after EHLO from unknown[187.144.218.53]
Jun 16 13:42:15 mail postfix/submission/smtpd[228650]: disconnect from unknown[187.144.218.53] ehlo=1 mail=0/1 commands=1/2
Jun 16 13:42:15 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:15 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]
Jun 16 13:42:16 mail postfix/submission/smtpd[228650]: lost connection after EHLO from unknown[187.144.218.53]
Jun 16 13:42:16 mail postfix/submission/smtpd[228650]: disconnect from unknown[187.144.218.53] ehlo=1 mail=0/1 commands=1/2
Jun 16 13:42:16 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:16 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]
Jun 16 13:42:17 mail postfix/submission/smtpd[228650]: lost connection after EHLO from unknown[187.144.218.53]
Jun 16 13:42:17 mail postfix/submission/smtpd[228650]: disconnect from unknown[187.144.218.53] ehlo=1 mail=0/1 commands=1/2
Jun 16 13:42:17 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:17 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]
Jun 16 13:42:18 mail postfix/submission/smtpd[228650]: lost connection after EHLO from unknown[187.144.218.53]
Jun 16 13:42:18 mail postfix/submission/smtpd[228650]: disconnect from unknown[187.144.218.53] ehlo=1 mail=0/1 commands=1/2
Jun 16 13:42:18 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:18 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]
Jun 16 13:42:19 mail postfix/submission/smtpd[228650]: lost connection after EHLO from unknown[187.144.218.53]
Jun 16 13:42:19 mail postfix/submission/smtpd[228650]: disconnect from unknown[187.144.218.53] ehlo=1 mail=0/1 commands=1/2
Jun 16 13:42:19 mail postfix/submission/smtpd[228650]: warning: hostname dsl-187-144-218-53-dyn.prod-infinitum.com.mx does not resolve to address 187.144.218.53: Name or service not known
Jun 16 13:42:19 mail postfix/submission/smtpd[228650]: connect from unknown[187.144.218.53]

如果我没记错的话，并且正确理解日志，因为我不知道“dyn.prod-infinitum.com”或“green.census.shodan.io”是谁，这些显然是未经授权的个人或实体的尝试试图登录我的电子邮件服务器。
我想要做的是使用fail2ban 或其他一些黑名单技术/实用程序来完全识别这些尝试登录失败的用户，然后将这些用户完全列入黑名单。理想情况下，我希望在 3 次或更多次失败的登录尝试后完全禁止这些用户访问我的整个 IP/域，包括我的网络服务器和电子邮件服务器。
Here is my pastebin link to my /etc/fail2ban/jail.local file .
在这个文件中，您会注意到我已经从 linuxbabe.com 指南中再次添加了一些后缀规则。添加了以下规则:

# Linuxbabe.com/mail-server/block-email-spam-postfix tutorial
[postfix]
enabled = true
maxretry = 2
bantime = 24h
filter = postfix
logpath = /var/log/mail.log
ignoreip = 127.0.0.1/8 ::1   
 
# Linuxbabe.com/mail-server/block-email-spam-postfix
[postfix-flood-attack]
enabled  = true
bantime  = 12h
maxretry = 2
filter   = postfix-flood-attack
action   = iptables-multiport[name=postfix, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath  = /var/log/mail.log
ignoreip = 127.0.0.1/8 ::1   
 
[postfix-rbl]
enabled  = true
filter   = postfix[mode=rbl]
port     = smtp,465,submission
logpath  = %(postfix_log)s
backend  = %(postfix_backend)s
maxretry = 1
ignoreip = 127.0.0.1/8 ::1

[postfix-sasl]
enabled  = true
filter   = postfix[mode=auth]
port     = smtp,465,submission,imap,imaps,pop3,pop3s
# You might consider monitoring /var/log/mail.warn instead if you are
# running postfix since it would provide the same log lines at the
# "warn" level but overall at the smaller filesize.
logpath  = %(postfix_log)s
backend  = %(postfix_backend)s

如何将登录尝试失败次数过多的用户列入我的电子邮件服务器的黑名单？

Answer 1

我不知道fail2ban 是否可以做到这一点，但我肯定会使用CrowdSec为了这。基本上它有点类似于fail2ban，但更现代和更先进，因为它可以检测更高级的攻击并且是分布式的。它是 FOSS，并通过允许所有用户分享他们看到的攻击的信息(当然是以匿名方式)来利用人群的力量，以便所有 CrowdSec 用户有效地互相帮助。并且支持 postfix也是。
与 fail2ban 一样，它读取日志并根据在日志中看到的内容检测攻击。而且它很容易安装，因为大多数 Linux 发行版、Windows、OPNsense、OpenWRT 都有二进制安装包，并且可以在 Docker 和 Kubernetes 上运行。安装说明是 here .
安装后，只需使用 cscli(内置 cli 工具)安装 postfix 集合:

sudo cscli collections install crowdsecurity/postfix

编辑/etc/crowdsec/acquis.yaml 以添加您的后缀日志:

---
filenames:
  - /var/log/mail.log
labels:
  type: syslog

(确保添加三个连字符。它是 yaml)。之后重新加载 crowdsec 就完成了。
如果你想要一个漂亮的图形概览谁在攻击你，最简单的方法是在 CrowdSec Console 上创建一个帐户。 , 免费使用的 SaaS 解决方案。
确保安装可用的防火墙弹跳器之一，否则 CrowdSec 实际上不会阻止任何东西。 CrowdSec 代理是检测 IDS 的部分，保镖是缓解威胁的 IPS 部分。
免责声明:我是 CrowdSec 的社区负责人。如果您喜欢我们的工具，请加入我们蓬勃发展的 Discord community .