# Fail2Ban filter for selected Postfix SMTP rejections

#

#

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from

# common.local

before = common.conf

[Definition]

_daemon = postfix\b([^\[\s]+)?

# optional port:

_port = (?::\d+)?

# optional prefix like `NOQUEUE: ` or `00ADB3C0899: ` etc...

_pref = (?:\w+: )?

# SMTP commands like RCPT etc

_cmd = [A-Z]{4,}

prefregex = ^%(__prefix_line)s%(_pref)s<mdpr-<mode>> <F-CONTENT>.+?</F-CONTENT>(?:, sasl_username=<F-USER>\S+</F-USER>)?\s*$

# Extended RE for normal mode to match reject by unknown users or undeliverable address, can be set to empty to avoid this:

exre-user = |[Uu](?:ser unknown|ndeliverable address) ; pragma: codespell-ignore

mdpr-normal = (?:(?:milter-)?reject:|(?:improper command pipelining|too many errors) after \S+)

mdre-normal=^%(_cmd)s from [^[]*\[<HOST>\]%(_port)s: [45][50][04] [45]\.\d\.\d+ (?:(?:<[^>]*>)?: )?(?:(?:Helo command|(?:Sender|Recipient) address) rejected: )?(?:Service unavailable|Access denied|(?:Client host|Command|Data command) rejected|Relay access denied|Malformed DNS server reply|(?:Host|Domain) not found|need fully-qualified hostname|match%(exre-user)s)\b

^from [^[]*\[<HOST>\]%(_port)s:?

mdad-normal =

mdpr-auth = warning:

mdre-auth = ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server| Invalid authentication mechanism)

mdre-auth2= ^[^[]*\[<HOST>\]%(_port)s: SASL ((?i)LOGIN|PLAIN|(?:CRAM|DIGEST)-MD5) authentication failed:(?! Connection lost to authentication server)

# todo: check/remove "Invalid authentication mechanism" from ignore list, if gh-1243 will get finished (see gh-1297).

mdad-auth =

mdad-auth2 =

# Mode "rbl" currently included in mode "normal", but if needed for jail "postfix-rbl" only:

mdpr-rbl = %(mdpr-normal)s

mdre-rbl = ^%(_cmd)s from [^[]*\[<HOST>\]%(_port)s: [45]54 [45]\.7\.1 Service unavailable; Client host \[\S+\] blocked\b

mdad-rbl =

# Mode "rbl" currently included in mode "normal" (within 1st rule)

mdpr-more = %(mdpr-normal)s

mdre-more = %(mdre-normal)s

mdad-more =

# Includes some of the log messages described in

# <http://www.postfix.org/POSTSCREEN_README.html>.

mdpr-ddos = (?:lost connection after (?!(?:DATA|AUTH)\b)[A-Z]+|disconnect(?= from \S+(?: \S+=\d+)* auth=0/(?:[1-9]|\d\d+))|(?:PREGREET \d+|HANGUP) after \S+|COMMAND (?:TIME|COUNT|LENGTH) LIMIT|warning:)

mdre-ddos = ^from [^[]*\[<HOST>\]%(_port)s:?

mdad-ddos = ^(?:Message delivery request|Connection) rate limit exceeded: \d+ from [^[]*\[<ADDR>\]

mdpr-extra = (?:%(mdpr-auth)s|%(mdpr-normal)s)

mdre-extra = %(mdre-auth)s

%(mdre-normal)s

mdad-extra =

mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)

mdre-aggressive = %(mdre-auth2)s

%(mdre-normal)s

mdad-aggressive = %(mdad-ddos)s

mdpr-errors = too many errors after \S+

mdre-errors = ^from [^[]*\[<HOST>\]%(_port)s$

mdad-errors =

failregex = <mdre-<mode>>

<mdad-<mode>>

# Parameter "mode": more (default combines normal and rbl), auth, normal, rbl, ddos, extra or aggressive (combines all)

# Usage example (for jail.local):

# [postfix]

# mode = aggressive

#

# # or another jail (rewrite filter parameters of jail):

# [postfix-rbl]

# filter = postfix[mode=rbl]

#

# # jail to match "too many errors", related postconf `smtpd_hard_error_limit`:

# # (normally included in other modes (normal, more, extra, aggressive), but this jail'd allow to ban on the first message)

# [postfix-many-errors]

# filter = postfix[mode=errors]

# maxretry = 1

#

mode = more

ignoreregex =

[Init]

journalmatch = _SYSTEMD_UNIT=postfix.service [email protected]

# Author: Cyril Jaquier