search

crowdsecurity / hub

Main repository for crowdsec scenarios/parsers
https://hub.crowdsec.net
150 stars 147 forks source link

[smtp] Extended postfix #1100

Closed LaurenceJJones closed 1 week ago

LaurenceJJones commented 2 weeks ago

I had some spare time over weekend and decided to update my configuration for my postfix servers. I have enforced new rules to stop spammers from exploiting common misconfiguration's I would like to parse and handle these HELO rejections separately from authentication failures as they are not the same thing.

2024-08-26T01:33:38.572449+00:00 laurencejones postfix/smtpd[60203]: NOQUEUE: reject: RCPT from unknown[94.141.120.122]: 504 5.5.2 <WIN-9QL4SDRB93L>: Helo command rejected: need fully-qualified hostname; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-9QL4SDRB93L>
2024-08-26T01:53:05.740447+00:00 laurencejones postfix/smtpd[60903]: NOQUEUE: reject: RCPT from unknown[94.141.120.122]: 504 5.5.2 <WIN-9QL4SDRB93L>: Helo command rejected: need fully-qualified hostname; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-9QL4SDRB93L>
2024-08-26T07:16:35.560178+00:00 laurencejones postfix/smtpd[208148]: NOQUEUE: reject: RCPT from unknown[185.103.110.251]: 504 5.5.2 <WIN-CLJ1B0GQ6JP>: Helo command rejected: need fully-qualified hostname; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-CLJ1B0GQ6JP>

The main problem is I would rather group on the from/to rather than IP as you can see the addresses are different each time.

LaurenceJJones commented 2 weeks ago

I would also like to parse and act on relay access commands

2024-08-25T12:31:56.154748+00:00 laurencejones postfix/smtpd[3887453]: NOQUEUE: reject: RCPT from unknown[157.245.73.5]: 454 4.7.1 <spameri@tiscali.it>: Relay access denied; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-CLJ1B0GQ6JP>
2024-08-25T16:25:14.097135+00:00 laurencejones postfix/smtpd[4001128]: NOQUEUE: reject: RCPT from unknown[94.156.177.65]: 454 4.7.1 <spameri@tiscali.it>: Relay access denied; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-7N1FIECL6IC>
2024-08-25T17:53:45.608776+00:00 laurencejones postfix/smtpd[4004444]: NOQUEUE: reject: RCPT from unknown[94.156.177.137]: 454 4.7.1 <spameri@tiscali.it>: Relay access denied; from=<spameri@tiscali.it> to=<spameri@tiscali.it> proto=ESMTP helo=<WIN-7N1FIECL6IC>