After a little while (very little) our mail server gets quite clogged. It does not cause much problem to our server, however, legal mail server will have a hard time to connect because all of those illegal mail server connect thousands of times to try sending us spam.

To give you an example, I blocked less than 10 IPs today and I got over 5,000 hits blocked within about 12 hours. That's to give you a picture of the badness of those scam robots.

I thus looked for a solution to automatically block those IPs. I found two things, one is a shell script. I do not recommend it since it is rather slow (also, please, remove the -i from the grep option it makes it 10 times slower!)

(Source: https://forum.howtoforge.com/threads/31681/)

#!/bin/bash
IPT=/sbin/iptables
LIMIT=5 # change this to the maximum number of rejected attempt your server will authorize

cd /usr/local/sbin/smtp_flood/ # change this to the path where youinstall the script

# first get hour of log
tail -n 400 /var/log/maillog | grep -i "`date +"%b %e %H:"`" > minutelog
# now extract the rejected attempts, sort and count uniq ip
cat minutelog | grep "reject:" | cut -d" " -f11 | cut -d"[" -f2 | cut
-d"]" -f 1 | sort | uniq -c | sort -n | sed 's/^[ \t]*//' > tmp1
# for each line in result
while read line
do
MYCOUNT=`echo $line | cut -d" " -f1`
MYIP=`echo $line | cut -d" " -f2`

if  [ $MYCOUNT -lt $LIMIT ] ;
then
echo $MYIP je ok: $MYCOUNT poskusov
else

ALREADY=`cat blocked.smtp | grep $MYIP | wc -l`

if  [ $ALREADY -eq "0" ] ;
then
echo blokiramo spemerja $MYIP z $MYCOUNT poskusi
$IPT -I INPUT -i eth0 --proto tcp -s $MYIP --destination-port 25 -j DROP
echo $MYIP >> blocked.smtp
else
echo $MYIP ze blokiran
fi
fi
done < tmp1
# remove temp files
rm -f minutelog
rm -f tmp1

The other solution is to look into fail2ban. That process is used to ban IP addresses for a while if something or other fails. The following is an example setup for that server:

file: /etc/fail2ban/jail.conf

[postfix-tcpwrapper]

enabled = true
filter = postfix
action = hostsdeny
sendmail[name=Postfix, dest=you@yourdomain.net]
logpath = /var/log/maillog
maxretry = 3
bantime = 900
findtime = 900

I did not yet install those, but plan to do that very soon as quite often I have to restart my mail server just so I can send emails!

fail2ban documentation can be found on the tool official website: ftp://ftp.porcupine.org/