Fail2Ban: regex pour relais smtp

Si vous mettez en place un relais smtp sur votre serveur, des robots peuvent tenter de forcer l’accès en force brute pour transformer votre machine en machine à SPAM.

Dans mes logs je peux facilement remarquer que 118.167.128.72 s’acharne à la tache (tout en étant assez intelligent pour ne pas exploser le max connection rate):

Feb 12 05:22:20 ubuntuserv postfix/smtpd[20950]: lost connection after RCPT from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:22:20 ubuntuserv postfix/smtpd[20950]: disconnect from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:25:40 ubuntuserv postfix/anvil[20952]: statistics: max connection rate 1/60s for (smtp:118.167.128.72) at Feb 12 05:22:19
Feb 12 05:25:40 ubuntuserv postfix/anvil[20952]: statistics: max connection count 1 for (smtp:118.167.128.72) at Feb 12 05:22:19
Feb 12 05:25:40 ubuntuserv postfix/anvil[20952]: statistics: max cache size 1 at Feb 12 05:22:19
Feb 12 05:31:20 ubuntuserv postfix/smtpd[22890]: connect from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:31:21 ubuntuserv postfix/smtpd[22890]: NOQUEUE: reject: RCPT from 118-167-128-72.dynamic.hinet.net[118.167.128.72]: 554 5.7.1 <s2288@mail2000.com.tw>: Relay access denied; from=<itidgh483987@hotmail.com> to=<s2288@mail2000.com.tw> proto=SMTP helo=<79.132.57.102>
Feb 12 05:31:22 ubuntuserv postfix/smtpd[22890]: lost connection after RCPT from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:31:22 ubuntuserv postfix/smtpd[22890]: disconnect from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:34:42 ubuntuserv postfix/anvil[22892]: statistics: max connection rate 1/60s for (smtp:118.167.128.72) at Feb 12 05:31:20
Feb 12 05:34:42 ubuntuserv postfix/anvil[22892]: statistics: max connection count 1 for (smtp:118.167.128.72) at Feb 12 05:31:20
Feb 12 05:34:42 ubuntuserv postfix/anvil[22892]: statistics: max cache size 1 at Feb 12 05:31:20
Feb 12 05:40:38 ubuntuserv postfix/smtpd[24764]: connect from 118-167-128-72.dynamic.hinet.net[118.167.128.72]
Feb 12 05:40:39 ubuntuserv postfix/smtpd[24764]: NOQUEUE: reject: RCPT from 118-167-128-72.dynamic.hinet.net[118.167.128.72]: 554 5.7.1 <s2288@mail2000.com.tw>: Relay access denied; from=<itidgh483987@hotmail.com> to=<s2288@mail2000.com.tw> proto=SMTP helo=<79.132.57.102>

Pour se protéger des attaques en force-brute le classique Fail2Ban, il manque juste l’expression régulière qui va bien:

NOQUEUE\: reject\: RCPT from .*\[<HOST>\]: .*: Relay access denied;

que l’on ajoute dans /etc/fail2ban/filter.d/couriersmtp.conf qui devient:

# Fail2Ban configuration file
#
# Author: Cyril Jaquier
#
# $Revision: 510 $
#
[Definition]
# Option:  failregex
# Notes.:  regex to match the password failures messages in the logfile. The
#          host must be matched by a group named "host". The tag "<HOST>" can
#          be used for standard IP/hostname matching and is only an alias for
#          (?:::f{4,6}:)?(?P<host>[\w\-.^_]+)
# Values:  TEXT
#
failregex = error,relay=<HOST>,.*550 User unknown
NOQUEUE\: reject\: RCPT from .*\[<HOST>\]: .*: Relay access denied;
# Option:  ignoreregex
# Notes.:  regex to ignore. If this regex matches, the line is ignored.
# Values:  TEXT
#
ignoreregex =

et on n’oublie pas de valider le filtre dans /etc/fail2ban/jail.conf en passant enabled à true dans la section couriersmtp

[couriersmtp]
enabled  = true
port     = smtp,ssmtp
filter   = couriersmtp
logpath  = /var/log/mail.log</pre>