CERBERUS/fail2ban
1
0
Fork 0
mirror of https://github.com/fail2ban/fail2ban.git synced 2026-08-29 04:49:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

filter.d/postfix: catch "hostname ... does not resolve to address" in aggressive mode

Browse source 
Postfix logs this warning when a client's reverse DNS does not resolve
back to its address. Bots trip it constantly, but so does a legitimate
sender with broken rDNS, so it only belongs in aggressive mode.

Regex as given by sebres in gh-4078 and confirmed working by the
reporter.

Closes gh-4078
This commit is contained in:
VXNCXNX 2026-08-14 16:02:39 +00:00
parent f127e6e6f0
commit 2b46485c7a
2 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
config/filter.d/postfix.conf
View file

@ -59,6 +59,7 @@ mdad-extra =
mdpr-aggressive = (?:%(mdpr-auth)s|%(mdpr-normal)s|%(mdpr-ddos)s)
mdre-aggressive = %(mdre-auth2)s
%(mdre-normal)s
^hostname \S+ does not resolve to address <ADDR>
mdad-aggressive = %(mdad-ddos)s
mdpr-errors = too many errors after \S+

4
fail2ban/tests/files/logs/postfix
View file

@ -198,3 +198,7 @@ Sep 19 12:10:58 hostname postfix/smtpd[14059]: warning: Message delivery request
# filterOptions: [{}, {"mode": "ddos"}, {"mode": "aggressive"}]
# failJSON: { "match": false, "desc": "don't affect lawful data (sporadical connection aborts within DATA-phase, see gh-1813 for discussion)" }
Feb 18 09:50:05 xxx postfix/smtpd[42]: lost connection after DATA from good-host.example.com[192.0.2.10]
# filterOptions: [{"mode": "aggressive"}]
# failJSON: { "match": true , "host": "192.0.2.44", "desc": "hostname does not resolve to address, aggressive only (gh-4078)" }
Aug 14 10:00:01 mail postfix/smtpd[1234]: warning: hostname bad.example.com does not resolve to address 192.0.2.44: Name or service not known