Postfix

A mail server with SMTP AUTH enabled is a magnet for password-guessing bots, which want it as a spam relay. Postfix logs each failure, so they are easy to report.

Report SASL brute force

Reports every address with five or more failed SMTP logins in the current log:

grep "SASL LOGIN authentication failed" /var/log/mail.log | grep -oE '\[[0-9a-fA-F.:]+\]' | tr -d '[]' | sort | uniq -c | awk '$1>=5{print $2}' | xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=mail-server-attack,brute-force -d comment="postfix: SASL brute force"

Change LOGIN to PLAIN, or drop it, to match other mechanisms. On systemd systems without a mail.log, pipe journalctl -u postfix --since "1 hour ago" in instead.

With fail2ban

fail2ban's postfix-sasl jail detects the same thing continuously. Add the isipsafe action with categories="mail-server-attack,brute-force".

Using the list to reject connections

To refuse SMTP connections from listed addresses, generate a CIDR table from the plain-text list and reference it in smtpd_client_restrictions:

curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&confidenceMinimum=90" | awk '{print $1" REJECT listed on isipsafe"}' > /etc/postfix/isipsafe.cidr && postfix reload

# main.cf
smtpd_client_restrictions = check_client_access cidr:/etc/postfix/isipsafe.cidr, permit

Need a hand?

If something here does not work with your version of Postfix, or you have improved it, tell us. We update these pages with what people send.

Postfix and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.