How to set up fail2ban to reduce constant connect requests from spammers? #2481

jayknyn · 2022-03-14T03:17:10Z

jayknyn
Mar 14, 2022

Hi all, I've successfully been running DMS for over a year now (just upgraded to v10.5.0 and thank you to all the maintainers and contributors) and lately I've been noticing in the logs that I'm getting constant Connect requests from the same (possibly spam) IP address with just the ports being different (up to 3 requests every second!). A few days ago, it was a different IP address with the same behavior.

I have fail2ban enabled for DMS and a few days ago, it had banned the offensive IP addresses but as the fail2ban db is purged by default every day, the next day, the same IP address was constantly hammering my port 25. I don't know if this is related, but before I upgraded to v10.5.0 with PERMIT_DOCKER=none, I was not able to receive any mails and I think it was due to zen.spamhaus.org flagging my mailserver as a source of spam. I checked that I am not running an open relay. After upgrading to v10.5.0 with the below config, my mails are arriving and I can send, but I am concerned about these constant connect requests and whether this affects my IP's reputation.

Is this to do with fail2ban configuration?
If so, what would you suggest I alter from the default jail config? fail2ban is set to ban an IP after 3 failed attempts in 10 mins.

From the below logs, are these connect requests resulting in a "fail"?
If so, how come fail2ban is not banning this IP?
If not, are there other suggestions on how to defend from these spammer connect requests?
Or should I just not worry about it?

My relevant config files:
I'm running this behind Traefik v2

# Docker-MailServer v10.5.0 with Traefik v2
version: '3.3'

networks:
  ingress:
    external: true

  mailserver:
    internal: true

services:
  mailserver:
    container_name: ${SERVICE_NAME}
    image: mailserver/docker-mailserver:${MAILSERVER_VERSION}
    hostname: ${SUB_DOMAIN}
    domainname: ${BASE_DOMAIN}
    env_file: mailserver.env
    environment: # override default env vars
      - TZ # timezone for mailserver from .env
      - OVERRIDE_HOSTNAME=${MAIL_SERVER_DOMAIN}
      - DMS_DEBUG=0 # 1 enable debug on startup, 0 = disable
      - SUPERVISOR_LOGLEVEL=error # info, critical, error, debug
      - ONE_DIR=1 # consolidate mail data into 1 dir for persistance
      - POSTMASTER_ADDRESS # default [email protected]
      - PERMIT_DOCKER=none # none = Explicitly force authentication
      - SPOOF_PROTECTION=1 # 0 to allow address tag sending
      - ENABLE_SRS=0 # 1 enable for forwarding
      - ENABLE_CLAMAV=1 # 1 enable
      - ENABLE_DNSBL=0 # 1 enable
      - ENABLE_FAIL2BAN=1 # 1 enable and add cap_add: NET_ADMIN below
      - ENABLE_MANAGESIEVE=1 # enable on port 4190
      - SSL_TYPE=letsencrypt # mount Traefik certs below
      - SSL_DOMAIN=${MAIL_SERVER_DOMAIN} # explicitly state SSL Domain for Traefik
      - ENABLE_SPAMASSASSIN=1 # 1 enable
      - ENABLE_POSTGREY=1 # 1 enable
      - POSTGREY_DELAY=60 # delay in seconds
      - POSTSCREEN_ACTION=ignore
    networks: [mailserver, ingress]
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.${SERVICE_NAME}.rule=Host(`${MAIL_SERVER_DOMAIN}`)
      - traefik.http.routers.${SERVICE_NAME}.entrypoints=websecure
      - traefik.http.routers.${SERVICE_NAME}.tls.certresolver=le
      - traefik.tcp.routers.smtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.smtp.entrypoints=smtp
      - traefik.tcp.routers.smtp.service=smtp
      - traefik.tcp.services.smtp.loadbalancer.server.port=25
      - traefik.tcp.services.smtp.loadbalancer.proxyProtocol.version=1
      - traefik.tcp.routers.esmtp.rule=HostSNI(`*`)
      - traefik.tcp.routers.esmtp.entrypoints=esmtp
      - traefik.tcp.routers.esmtp.service=esmtp
      - traefik.tcp.services.esmtp.loadbalancer.server.port=465
      - traefik.tcp.services.esmtp.loadbalancer.proxyProtocol.version=1
      - traefik.tcp.routers.imap-secure.rule=HostSNI(`*`)
      - traefik.tcp.routers.imap-secure.entrypoints=imap-secure
      - traefik.tcp.routers.imap-secure.service=imap-secure
      # Port 10993 is used here to avoid conflicts with internal systems
      - traefik.tcp.services.imap-secure.loadbalancer.server.port=10993
      - traefik.tcp.services.imap-secure.loadbalancer.proxyProtocol.version=2
      - traefik.tcp.routers.pop3-secure.rule=HostSNI(`*`)
      - traefik.tcp.routers.pop3-secure.entrypoints=pop3-secure
      - traefik.tcp.routers.pop3-secure.service=pop3-secure
      - traefik.tcp.services.pop3-secure.loadbalancer.server.port=995
      - traefik.tcp.services.pop3-secure.loadbalancer.proxyProtocol.version=2
      - traefik.tcp.routers.sieve.rule=HostSNI(`*`)
      - traefik.tcp.routers.sieve.entrypoints=sieve
      - traefik.tcp.routers.sieve.service=sieve
      - traefik.tcp.services.sieve.loadbalancer.server.port=4190
    volumes:
      - ./maildata:/var/mail
      - ./mailstate:/var/mail-state
      - ./maillogs:/var/log/mail
      - ./config/:/tmp/docker-mailserver/
      - ${CERTS_PATH}/acme.json:/etc/letsencrypt/acme.json:ro
    cap_add:
      - NET_ADMIN
      - SYS_PTRACE

traefik compose:

version: "3.3"

networks:
  ingress:
    external: true

  traefik:
    internal: true

services:
  traefik:
    container_name: traefik-app
    image: traefik:${TRAEFIK_VERSION}
    depends_on: [dockerproxy, watchtower]
    networks: [traefik, ingress]
    ports:
      - "80:80"
      - "443:443"
      # Ports for Docker-MailServer
      - "25:25" # SMTP receiving, explicit TLS
      - "465:465" # ESMTP submission, implicit TLS
      - "993:993" # IMAP4 secure, implicit TLS
      - "995:995" # POP3 secure, implicit TLS
      - "4190:4190" # sieve
    restart: always
    command:
      - --log.level=DEBUG # DEBUG, PANIC, FATAL, ERROR, WARN, INFO
      # Activate dashboard
      - --api=true
      # Activate /ping healthcheck endpoint
      - --ping=true
      - --ping.manualRouting=true
      - --ping.entrypoint=websecure
      # Activate docker provider, but do not expose every container to traefik
      - --providers.docker=true
      - --providers.docker.exposedbydefault=false
      - --providers.docker.endpoint=tcp://dockerproxy:2375
      - --providers.docker.network=ingress
      # Extra provider for TLS config via file provider
      - --providers.file=true
      - --providers.file.filename=/dynamic.yml
      - --providers.file.watch=true
      # HTTPS entrypoints, need 80 for redirect
      - --entrypoints.webinsecure.address=:80
      - --entrypoints.websecure.address=:443
      # TCP entrypoints for Docker-MailServer
      - --entryPoints.smtp.address=:25
      - --entryPoints.esmtp.address=:465
      - --entryPoints.imap-secure.address=:993
      - --entryPoints.pop3-secure.address=:995
      - --entryPoints.sieve.address=:4190

config/dovecot.cf:

haproxy_trusted_networks = 172.18.0.0/16
haproxy_timeout = 3 secs
service imap-login {
  inet_listener imaps {
    haproxy = yes
    ssl = yes
    port = 10993
  }
}

config/postfix-main.cf:

postscreen_upstream_proxy_protocol = haproxy

config/postfix-master.cf:

submission/inet/smtpd_upstream_proxy_protocol=haproxy
smtps/inet/smtpd_upstream_proxy_protocol=haproxy

Startup:

Attaching to mailserver
mailserver    | [ TASKLOG ]  Welcome to docker-mailserver 10.5.0
mailserver    | [ TASKLOG ]  Initializing setup
mailserver    | [ TASKLOG ]  Checking configuration
mailserver    | [ TASKLOG ]  Configuring mail server
mailserver    | Restarted supervisord
mailserver    | [ TASKLOG ]  Welcome to docker-mailserver 10.5.0
mailserver    | [ TASKLOG ]  Initializing setup
mailserver    | [ TASKLOG ]  Checking configuration
mailserver    | [ TASKLOG ]  Configuring mail server
mailserver    | [ TASKLOG ]  Post-configuration checks
mailserver    | [ TASKLOG ]  Starting daemons & mail server
mailserver    | cron: started
mailserver    | rsyslog: started
mailserver    | dovecot: started
mailserver    | opendkim: started
mailserver    | opendmarc: started
mailserver    | postgrey: started
mailserver    | postfix: started
mailserver    | fail2ban: started
mailserver    | clamav: started
mailserver    | changedetector: started
mailserver    | amavis: started
mailserver    | [ TASKLOG ]  mail.domain.com is up and running

Sample of current logs:

Mar 13 21:48:42 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:52560 to [172.18.0.2]:25
Mar 13 21:48:42 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:52560: EHLO ylmf-pc\r\n
Mar 13 21:48:42 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:42 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]
Mar 13 21:48:42 mail postfix/smtpd[788290]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 21:48:42 mail postfix/smtpd[788290]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 21:48:42 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:53617 to [172.18.0.2]:25
Mar 13 21:48:43 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:53617: EHLO ylmf-pc\r\n
Mar 13 21:48:43 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:43 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 21:48:43 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:54930 to [172.18.0.2]:25
Mar 13 21:48:43 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:54930: EHLO ylmf-pc\r\n
Mar 13 21:48:43 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:43 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 21:48:43 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:56078 to [172.18.0.2]:25
Mar 13 21:48:43 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:56078: EHLO ylmf-pc\r\n
Mar 13 21:48:43 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:43 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 21:48:43 mail postfix/smtpd[788290]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 21:48:44 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:57585 to [172.18.0.2]:25
Mar 13 21:48:44 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:57585: EHLO ylmf-pc\r\n
Mar 13 21:48:44 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:44 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]
Mar 13 21:48:44 mail postfix/smtpd[788290]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 21:48:44 mail postfix/smtpd[788290]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 21:48:44 mail postfix/postscreen[768926]: CONNECT from [45.148.10.75]:58679 to [172.18.0.2]:25
Mar 13 21:48:44 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:58679: EHLO ylmf-pc\r\n
Mar 13 21:48:44 mail postfix/smtpd[788290]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 21:48:44 mail postfix/smtpd[788290]: connect from unknown[45.148.10.75]

(sending myself a test email from an outlook account)

Mar 13 22:27:29 mail postfix/smtpd[5204]: connect from unknown[45.148.10.75]
Mar 13 22:27:29 mail postfix/smtpd[5204]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:29 mail postfix/smtpd[5204]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:29 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:64625 to [172.18.0.2]:25
Mar 13 22:27:29 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:64625: EHLO ylmf-pc\r\n
Mar 13 22:27:29 mail postfix/smtpd[5204]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:29 mail postfix/smtpd[5204]: connect from unknown[45.148.10.75]
Mar 13 22:27:29 mail postfix/smtpd[5204]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:29 mail postfix/smtpd[5204]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:29 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:58086 to [172.18.0.2]:25
Mar 13 22:27:30 mail postfix/postscreen[2121]: PASS NEW [40.92.63.154]:52037
Mar 13 22:27:30 mail postfix/postscreen[2121]: PREGREET 14 after 0.54 from [45.148.10.75]:58086: EHLO ylmf-pc\r\n
Mar 13 22:27:30 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:30 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:30 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:30 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:30 mail postfix/smtpd[5204]: connect from mail-me3aus01olkn2154.outbound.protection.outlook.com[40.92.63.154]
Mar 13 22:27:30 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:61108 to [172.18.0.2]:25
Mar 13 22:27:30 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:61108: EHLO ylmf-pc\r\n
Mar 13 22:27:30 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:30 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:30 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:30 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:31 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:63295 to [172.18.0.2]:25
Mar 13 22:27:31 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:63295: EHLO ylmf-pc\r\n
Mar 13 22:27:31 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:31 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:31 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:58730 to [172.18.0.2]:25
Mar 13 22:27:31 mail postfix/smtpd[5204]: Anonymous TLS connection established from mail-me3aus01olkn2154.outbound.protection.outlook.com[40.92.63.154]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)
Mar 13 22:27:31 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:58730: EHLO ylmf-pc\r\n
Mar 13 22:27:31 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:31 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:31 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:49680 to [172.18.0.2]:25
Mar 13 22:27:31 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:49680: EHLO ylmf-pc\r\n
Mar 13 22:27:31 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:31 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:31 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:32 mail policyd-spf[5276]: prepend Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=40.92.63.154; helo=aus01-me3-obe.outbound.protection.outlook.com; [email protected]; receiver=<UNKNOWN> 
action=pass, reason=client whitelist, client_name=mail-me3aus01olkn2154.outbound.protection.outlook.com, client_address=40.92.63.154/32, [email protected], [email protected]
Mar 13 22:27:32 mail postfix/smtpd[5204]: 0A7D83B171E: client=mail-me3aus01olkn2154.outbound.protection.outlook.com[40.92.63.154]
Mar 13 22:27:32 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:55537 to [172.18.0.2]:25
Mar 13 22:27:32 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:55537: EHLO ylmf-pc\r\n
Mar 13 22:27:32 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:32 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/cleanup[5278]: 0A7D83B171E: message-id=<ME3P282MB1522DC1C326AFA3999A062BE920F9@ME3P282MB1522.AUSP282.PROD.OUTLOOK.COM>
Mar 13 22:27:32 mail opendkim[750]: 0A7D83B171E: mail-me3aus01olkn2154.outbound.protection.outlook.com [40.92.63.154] not internal
Mar 13 22:27:32 mail opendkim[750]: 0A7D83B171E: not authenticated
Mar 13 22:27:32 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:32 mail opendkim[750]: 0A7D83B171E: DKIM verification successful
Mar 13 22:27:32 mail opendkim[750]: 0A7D83B171E: s=selector1 d=outlook.com a=rsa-sha256 SSL 
Mar 13 22:27:32 mail opendmarc[756]: 0A7D83B171E: outlook.com pass
Mar 13 22:27:32 mail postfix/qmgr[1972]: 0A7D83B171E: from=<[email protected]>, size=7592, nrcpt=1 (queue active)
Mar 13 22:27:32 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:62282 to [172.18.0.2]:25
Mar 13 22:27:32 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:62282: EHLO ylmf-pc\r\n
Mar 13 22:27:32 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:32 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/smtpd[5204]: disconnect from mail-me3aus01olkn2154.outbound.protection.outlook.com[40.92.63.154] ehlo=2 starttls=1 mail=1 rcpt=1 bdat=1 quit=1 commands=7
Mar 13 22:27:32 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:32 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:57559 to [172.18.0.2]:25
Mar 13 22:27:32 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:57559: EHLO ylmf-pc\r\n
Mar 13 22:27:32 mail postfix/smtpd[5204]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:32 mail postfix/smtpd[5204]: connect from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/smtpd[5204]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:32 mail postfix/smtpd[5204]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:33 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:52584 to [172.18.0.2]:25
Mar 13 22:27:33 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:52584: EHLO ylmf-pc\r\n
Mar 13 22:27:33 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:33 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]
Mar 13 22:27:33 mail postfix/smtpd[5267]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:33 mail postfix/smtpd[5267]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:33 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:49488 to [172.18.0.2]:25
Mar 13 22:27:33 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:49488: EHLO ylmf-pc\r\n
Mar 13 22:27:33 mail postfix/smtpd[5204]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:33 mail postfix/smtpd[5204]: connect from unknown[45.148.10.75]
Mar 13 22:27:33 mail postfix/smtpd[5204]: lost connection after EHLO from unknown[45.148.10.75]
Mar 13 22:27:33 mail postfix/smtpd[5204]: disconnect from unknown[45.148.10.75] ehlo=1 commands=1
Mar 13 22:27:33 mail postfix/postscreen[2121]: CONNECT from [45.148.10.75]:55817 to [172.18.0.2]:25
Mar 13 22:27:33 mail postfix/smtpd[5290]: connect from localhost[127.0.0.1]
Mar 13 22:27:33 mail postfix/smtpd[5290]: B07BE3B18AE: client=localhost[127.0.0.1]
Mar 13 22:27:33 mail postfix/cleanup[5278]: B07BE3B18AE: message-id=<ME3P282MB1522DC1C326AFA3999A062BE920F9@ME3P282MB1522.AUSP282.PROD.OUTLOOK.COM>
Mar 13 22:27:33 mail postfix/postscreen[2121]: PREGREET 14 after 0.09 from [45.148.10.75]:55817: EHLO ylmf-pc\r\n
Mar 13 22:27:33 mail postfix/smtpd[5267]: warning: hostname somado.me does not resolve to address 45.148.10.75
Mar 13 22:27:33 mail postfix/smtpd[5267]: connect from unknown[45.148.10.75]

casperklein · 2022-03-15T19:00:23Z

casperklein
Mar 15, 2022
Maintainer

as the fail2ban db is purged by default every day

How do you come to this conclusion? This would make no sense, e.g. if you configure a ban time > 1 day 😉

I was not able to receive any mails and I think it was due to zen.spamhaus.org flagging my mailserver

I don't think it's related. When block listed, DMS would not be able to send mails, but receiving shouldn't be a problem.

If so, what would you suggest I alter from the default jail config? fail2ban is set to ban an IP after 3 failed attempts in 10 mins.

You could increase that ban time value to one week or so.

Mar 13 21:48:43 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:54930: EHLO ylmf-pc\r\n

A quick research for this unusual EHLO --> EHLO ylmf-pc let me think, that this IP address is part of a botnet.

1 reply

jayknyn Mar 16, 2022
Author

Hi Casper, thanks for your response.

as the fail2ban db is purged by default every day

How do you come to this conclusion? This would make no sense, e.g. if you configure a ban time > 1 day 😉

I presumed that from seeing this config param in /etc/fail2ban/fail2ban.conf and also here in the fail2ban config example.

root@mail:/etc/fail2ban# cat fail2ban.conf | grep dbpurgeage
# Options: dbpurgeage
dbpurgeage = 1d
root@mail:/etc/fail2ban#

I was not able to receive any mails and I think it was due to zen.spamhaus.org flagging my mailserver

I don't think it's related. When block listed, DMS would not be able to send mails, but receiving shouldn't be a problem.

That's what I thought, as well. If my IP has been blacklisted, then sending mails will be an issue, not receiving.

If so, what would you suggest I alter from the default jail config? fail2ban is set to ban an IP after 3 failed attempts in 10 mins.

You could increase that ban time value to one week or so.

I will try that. Thanks.

Mar 13 21:48:43 mail postfix/postscreen[768926]: PREGREET 14 after 0.09 from [45.148.10.75]:54930: EHLO ylmf-pc\r\n

A quick research for this unusual EHLO --> EHLO ylmf-pc let me think, that this IP address is part of a botnet.

Thanks for that. Searching for this host brings up results of others also getting brute force attacked by this botnet.

For the past day, I am not seeing any more of these connect from requests getting to the pregreet with EHLO. To help me understand, do you think this has to do with setting PERMIT_DOCKER=none and forcing authentication?

casperklein · 2022-03-16T14:12:20Z

casperklein
Mar 16, 2022
Maintainer

I presumed that from seeing this config param in /etc/fail2ban/fail2ban.conf and also here in the fail2ban config example.

Good catch. I just checked my setup, I have also dbpurgeage = 1d configured. However, I definitely have IPs banned for more than 1 day.

Edit: It seems, that dbpurgeage does not affect the ban time, but instead cares for the history of bans kept in the sqlite DB:

dbpurgeage <SECONDS> # sets the max age in <SECONDS> that history of bans will be kept

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Docker Mailserver

How to set up fail2ban to reduce constant connect requests from spammers? #2481

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Docker Mailserver

How to set up fail2ban to reduce constant connect requests from spammers? #2481

Uh oh!

Uh oh!

jayknyn Mar 14, 2022

Replies: 2 comments · 1 reply

Uh oh!

casperklein Mar 15, 2022 Maintainer

Uh oh!

jayknyn Mar 16, 2022 Author

Uh oh!

Uh oh!

casperklein Mar 16, 2022 Maintainer

jayknyn
Mar 14, 2022

Replies: 2 comments 1 reply

casperklein
Mar 15, 2022
Maintainer

jayknyn Mar 16, 2022
Author

casperklein
Mar 16, 2022
Maintainer