主页 / user-618297

Megver83's questions

Martin Hope
Megver83
Asked: 2019-10-29 17:53:52 +0800 CST
  • 5

我的疑问是，使用 RBL 代替反垃圾邮件程序是否太不同了？（如 SpamAssassin）

我有一个 Postfix + Dovecot 服务器，在 Postfix 中有一些 RBL，并且禁用了 SpamAssassin，因为它让我很挣扎。但是，然后我质疑仅在 RBL 中转播是否明智，或者是否有任何不同。我想这也可能取决于我使用的 RBL。

我目前有：

  • zen.spamhaus.org
  • bl.spamcop.net
  • cbl.abuseat.org
  • 组合.rbl.msrbl.net

并且曾经有 dnsbl.sorbs.net，但它阻止了一些我想要的非垃圾邮件。

email postfix
Martin Hope
Megver83
Asked: 2019-10-27 16:07:29 +0800 CST
  • 5

我已经将 fail2ban 0.9.6 与 iptables 1.6.2 一起使用，并且我正在使用它来阻止攻击者，该攻击者从几天以来一直在戏弄我的电子邮件服务器（典型的 Dovecot + Postfix 安装）。一切正常，配置文件，日志文件等，但它并没有真正禁止攻击者的 IP 地址，因为我可以看到他试图访问 /var/log/mail.log，即使在 fail2ban 禁止它之后也是如此。

这是来自该攻击者的日志摘录：

Oct 27 00:05:55 servidor dovecot: auth: Debug: passwd-file(jade@de-chile.cl,92.118.38.54): lookup: user=jade@de-chile.cl file=/etc/passwd-file
Oct 27 00:05:55 servidor dovecot: auth: passwd-file(jade@de-chile.cl,92.118.38.54): unknown user (given password: password)
Oct 27 00:05:57 servidor dovecot: auth: Debug: client passdb out: FAIL#0111#011user=jade@de-chile.cl
Oct 27 00:05:57 servidor postfix/smtps/smtpd[2047]: warning: unknown[92.118.38.54]: SASL LOGIN authentication failed: UGFzc3dvcmQ6
Oct 27 00:06:06 servidor postfix/smtps/smtpd[2047]: lost connection after AUTH from unknown[92.118.38.54]
Oct 27 00:06:06 servidor postfix/smtps/smtpd[2047]: disconnect from unknown[92.118.38.54] ehlo=1 auth=0/1 rset=1 commands=2/3

他尝试了许多用户名，并且始终使用相同的密码。这是 fail2ban-client 的状态，但是：

$ sudo fail2ban-client status dovecot-pop3imap
Status for the jail: dovecot-pop3imap
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     16
|  `- File list:        /var/log/mail.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   92.118.38.54

$ sudo fail2ban-client status postfix-sasl
Status for the jail: postfix-sasl
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     17
|  `- File list:        /var/log/mail.log
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

我想知道为什么 IP 在 dovecot-pop3imap 中被禁止，但在 postfix-sasl 中没有（这是功能吗？不在不同的配置文件中重复相同的禁令？）

这是我的 /etc/fail2ban/jail.local 文件：

 # Configuración pensada para usarse junto con iptables

 # RESOURCES:
 # * https://wiki.archlinux.org/index.php/Fail2ban
 # * https://wiki.dovecot.org/HowTo/Fail2Ban
 # * https://www.fail2ban.org/wiki/index.php/HOWTO_fail2ban_spanish
 # * https://www.linode.com/docs/security/using-fail2ban-for-security/
 # * https://wiki.gentoo.org/wiki/Fail2ban
 # * https://www.fail2ban.org/wiki/index.php/HOWTOs

 [DEFAULT]
 bantime = 3600
 destemail = d@de-chile.cl
 sender = d@de-chile.cl

 # to ban & send an e-mail with whois report to the destemail.
 action = %(action_mw)s

 # same as action_mw but also send relevant log lines
 #action = %(action_mwl)s

 maxretry = 5

 # Dovecot
 [dovecot-pop3imap]
 enabled = true
 filter = dovecot-pop3imap
 action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]
 logpath = /var/log/mail.log
 #maxretry = 5
 findtime = 1200
 #bantime = 3600

 # Postfix
 [postfix]
 enabled = true
 filter = postfix
 action = iptables-multiport[name=postfix, port="smtp,submissions,submission", protocol=tcp]
 logpath = /var/log/mail.log
 #maxretry = 5
 #bantime = 3600

 [postfix-sasl]
 enabled = true
 filter = postfix-sasl
 action = iptables-multiport[name=postfix, port="smtp,submissions,submission", protocol=tcp]
 logpath = /var/log/mail.log
 #maxretry = 5
 #bantime = 3600

 [postfix-rbl]
 enabled = true
 filter = postfix-rbl
 action = iptables-multiport[name=postfix, port="smtp,submissions,submission",p rotocol=tcp]
 logpath = /var/log/mail.log
 #maxretry = 5
 #bantime = 3600

来自 iptables 的信息：

$ sudo iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 4881 packets, 247K bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1       95 12521 f2b-dovecot  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 110,995,143,993
2     2697  133K f2b-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
3     2697  133K f2b-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587
4     2698  133K f2b-postfix  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 25,465,587

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 23063 packets, 1114K bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain f2b-dovecot (1 references)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 REJECT     all  --  *      *       92.118.38.54         0.0.0.0/0            reject-with icmp-port-unreachable
2       95 12521 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Chain f2b-postfix (3 references)
num   pkts bytes target     prot opt in     out     source               destination         
1     8092  398K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
2        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0           
3        0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

PS：我不想手动阻止这个特定的IP，因为我希望禁止过程是自动的

security firewall