0

I have set up a working SMTP relay together with MailScanner. This SMTP relay is not — and will not be — able to relay email from the outside, only local email.

We are providing a SMTP relay for our customer so they can get notification from for example their Wordpress site. But sometimes - as you all know, the sites will be hacked and could start spamming emails (10k/ hour). I want to use fail2ban to block a server to do so.

For example: Customers site has been hacked and one of their vhost is spamming alot of emails. Fail2Ban detects the flood and block all trafic on port 25 from that server - and send me a email that "Server B has been blocked due to smtp-flood".

How can this be achieved?

Orphans
  • 1,404
  • 17
  • 26

2 Answers2

1

As you use postfix, look at anvil configuration : it allow to limit the connections (without email to you). You can then use fail2ban to read the postfix logs and drop the connection and inform you by mail (look at http://www.postfix.org/postconf.5.html#smtpd_client_connection_rate_limit)

Dom
  • 6,628
  • 1
  • 19
  • 24
0

I found out that I can block it with iptables:

iptables -A INPUT -p tcp -m tcp --dport 25 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 25 -m state --state NEW -m recent --set --name DEFAULT --rsource

If a client send more then 4 emails per minute, it's getting blocked.

Orphans
  • 1,404
  • 17
  • 26