mail-abuse Gratuit

Relay attempts and non-SMTP commands on the mail ports — spamware and scanners talking to Postfix, blocked on the first refusal

Catégorie

mail

Seuil

2/10m

Politique de ban

attack

Signalement

mail-spam

Parseurs

postfix-relay-denied postfix-non-smtp

Pourquoi elle est écrite ainsi

Le fichier de la règle Voir le brut

# Using the mail server for what it is not: a relay attempt (a second
# one within ten minutes — the first can be a misconfigured client,
# CrowdSec's postfix-relay-denied: capacity 1, leakspeed 10m) or a
# non-SMTP command on the SMTP port, which is a scanner and counts
# double (CrowdSec's postfix-non-smtp-command, a trigger).
rule: mail-abuse
description: "Relay attempts and non-SMTP commands on the mail ports — spamware and scanners talking to Postfix, blocked on the first refusal"
about:
  purpose: >-
    Stop your mail server being used for what it is not — relaying somebody else's mail, or answering a scanner.
  blocks: >-
    A second relay attempt within ten minutes (the first can be a misconfigured client), or a non-SMTP command on the SMTP port, which counts double.
  applies_to: >-
    Any machine running Postfix.
  requires:
    - >-
      The mail log, declared as `log: mail` — /var/log/mail.log on Debian and Ubuntu, /var/log/maillog on RHEL and its family.
    - >-
      The mail ports declared beside that log, so a ban closes the mail and leaves the websites alone.
  beware:
    - >-
      A customer's own client, newly set up and pointing at the wrong server, produces the first relay refusal. The threshold starts at two for exactly that reason.
category: mail
parsers:
  - parser: postfix-relay-denied
    weight: 1
  - parser: postfix-non-smtp
    weight: 2
threshold: 2/10m
ban: attack
report: mail-spam