Limit SASL Login failure attempts

[jonathanross]

Hi All,

I cannot for the life of me (and I've done lots of reading) figure out how to stop someone hammering our Mail Servers with SASL login attempts.

I've limited TLS connections and SMTP connections which helps other types of floods but I'd like to stop someone running a dictionary-type attack and drop their connection after three password failures.

An Postfix gurus aware of a fix ?

Many thanks,

JR

 

[Noway2]

I don't recall anything in Postfix itself that has this functionality. The closest that it may come is to choke off functions after too many errors, as defined by the hard limit and soft limit on errors.

I believe that Fail2Ban can do this, which is commonly used for this purpose on SSH servers. You may need to create a custom rule for postfix if one doesn't exist, which pretty much amounts to writing a regex expression.

 

[jonathanross]

Thanks very much, I hadn't thought of that.

This looks useful:

http://www.fail2ban.org/wiki/index.php/Postfix

JR